Repository navigation
fix(security): reject TLS chains through the compromised eMudhra intermediates (INC-289) - #94
Merged
Merged
Conversation
…rmediates (INC-289) The `mcp start` CLI now rejects chains that contain one of the eight compromised eMudhra intermediate keys (same SPKI list as Node.js #66871 and Go CVE-2026-111943), on Node.js via tls.checkServerIdentity and on Bun by wrapping fetch. It warns on stderr when the runtime has no native fix (Node.js below 22.23.4 / 24.22.1 / 26.12.1, and every Bun release). The Docker image moves from distroless Node.js 24.2.0 to node:24.22.1-bookworm-slim (pinned by digest) and runs as the node user. The README drops the standalone Bun binaries and documents the patched Node.js versions. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Generated-by: termag
wchieng
approved these changes
Oct 21, 2026
wchieng
left a comment
wchieng
left a comment
Contributor
There was a problem hiding this comment.
Changes look good, but you may want to bump the package.json version and add a github action/workflow to run the new tests you added.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Generated-by: termag
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Generated-by: termag
LVLNo1One
pushed a commit
to LVLNo1One/NoOne
that referenced
this pull request
Oct 26, 2026
Bump releaseVersion in .speakeasy/gen.lock so the Publish workflow ships 0.7.1 to npm. launchdarkly#94 bumped every other version field but not this one. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Generated-by: termag
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
For INC-289,
mcp startnow rejects TLS chains through the eight compromised eMudhra intermediate keys on both Node.js and Bun. It uses the same SPKI list as Node.js #66871 and Go 1.26.10, and it warns on stderr when the runtime has no native fix. The Docker image moves from distroless Node.js 24.2.0 tonode:24.22.1-bookworm-slim(pinned by digest, runs asnode). The README drops the standalone Bun binaries and lists the patched Node.js versions. Customers only get this from a new npm release and image push, so a release is needed after merge.🤖 Generated with Claude Code
Opened from termag
Note
Overview
INC-289 (0.7.1) adds defense-in-depth against TLS chains that use compromised eMudhra intermediate CAs, which could expose LaunchDarkly API tokens on outbound connections.
On
mcp start, the server installs a TLS blocklist before any traffic: it rejects chains matching Node’s blocked SPKI set (and issuer-name checks for Bun’s leaf-only view), patchestls.checkServerIdentityon Node or wrapsfetchon Bun, and prints a stderr warning when the runtime does not natively block those keys.tls-blocklist.tsis hand-maintained (listed in.genignore) withtest:tls-blocklistin CI.Docker switches from distroless Node 24.2.0 to pinned
node:24.22.1-bookworm-slim, runs asnode, and updates the entrypoint. README documents patched Node versions, image 0.7.1+, and deprecates standalone Bun binaries; the standalone install section is removed.Reviewed by Cursor Bugbot for commit 845bc07. Bugbot is set up for automated code reviews on this repo. Configure here.