Vercel says compromised eMudhra certificate authority keys still put Node.js 20 and runtimes you install yourself at risk

Vercel's security bulletin, dated October 27, 2026, says that on October 17 researchers found the private keys for eight intermediate certificate authorities operated by eMudhra (emSign) could be recovered. Anyone holding those keys could issue a trusted certificate for any website. eMudhra revoked the intermediates on October 18, and Vercel says the major browsers and operating systems blocked them within days. The bulletin warns that revocation alone does not protect most non-browser clients, because they never check revocation status. Node.js, Python's certifi package, Go and most container images each carry their own list of trusted roots, and each list stays exposed until it is updated.

Vercel says most projects need no action. It updated builds, Vercel Functions, Sandbox images and Image Optimization, and projects on Node.js 22 or newer receive the update without a redeploy. Vercel says it is still rolling the change across its managed Node.js runtimes for Functions. Projects still on Node.js 20.x must change to 22 or newer and redeploy, because Node.js 20 is end of life and will not receive an updated certificate list. Vercel does not manage runtimes and packages you install or pin yourself, including Node.js or Python installed inside a Sandbox or custom base image, container images you build, and pinned certifi packages. Update these to releases that drop the affected roots, or rebuild on an updated base image. The roots to look for are AAA Certificate Services, emSign Root TLS CA - G3 and emSign ECC Root CA - G3.

Outside Vercel, the bulletin lists external backends, CI runners and developer machines. It says Node.js 22.23.4, 24.22.1 and 26.12.1, certifi 2026.10.19 and Homebrew's current ca-certificates package drop the affected roots. The Node.js October 21, 2026 security release lists the certificate update as "ca-cert (eMudhra Intermediate CA Compromise)" for 26.x, 24.x and 22.x. Vercel says a client is exposed when it still trusts the eMudhra roots and connects over a network an attacker can intercept, such as public Wi-Fi or hijacked DNS, and that inbound traffic to your site is not affected. Vercel advises avoiding untrusted networks on machines that have not been updated.