JA EN
shiichan

Workers Builds and Pages build images now reject compromised eMudhra certificates!

Cloudflare Changelog ★★★ View Markdown
#cloudflare#security#serverless

Hi, Shii-chan here! Today's news is security related: the certificates in the build environment have been updated!

Cloudflare Changelog developers.cloudflare.com

What was announced?

According to the Cloudflare Changelog, the private keys of eight eMudhra intermediate certificate authorities (CAs) can be recovered. That means anyone can forge a certificate for any hostname that chains to them.

Because of this, the Workers Builds and Pages build images now reject these certificates when your build:

  • Clones your repository
  • Installs dependencies
  • Makes HTTPS requests

Why it matters

Builds fetch source code and dependencies over HTTPS. If forged certificates were trusted, you could not be sure who you were talking to. So the build environment no longer trusts them.

What changes

Most projects need no changes. The updated images include:

  • Patched CA certificates
  • Node.js 22.23.4 and 24.22.1
  • Bun 1.4.4
  • pip 26.2.2

Build commands also run with environment variables that point older runtimes at the patched CA certificates.

Dive Deep

Update your project if any of these apply:

  • You set BUN_VERSION below 1.4.4: older Bun versions trust the compromised certificates
  • You set your own SSL_CERT_FILE, PIP_CERT, or REQUESTS_CA_BUNDLE, or set --use-bundled-ca in NODE_OPTIONS: make sure your CA certificates do not trust the compromised intermediates
  • Your build installs tools that ship their own CA certificates: update them to a version that removes the compromised intermediates

For details, see the build image documentation for Workers Builds and Pages.

Wrap-up

  • The private keys of eight eMudhra intermediate CAs can be recovered, so forged certificates are possible
  • Workers Builds and Pages build images now reject them
  • Most projects need no action
  • Check for old pinned Bun versions, custom CA settings, and tools that bundle their own CAs

If you pin versions or CA settings in Cloudflare builds, give it a quick look!

Related posts