eMudhra/emSign CA compromise (October 2026): what Cloud SDK Node.js Libraries developers need to do #9814

Summary

Eight eMudhra (emSign) intermediate CA certificates have recoverable private keys (Mozilla bug 2083449). Clients whose trust store still contains emSign ECC Root CA - G3, emSign Root TLS CA - G3 or AAA Certificate Services can be impersonated by an on-path attacker.

The following packages and trust stores are affected

• The Node.js runtime's built-in root certificate store.
• The deprecated native grpc npm package, which bundles a root store and will not be updated.

You can take the following actions to resolve these issues

• Upgrade Node.js to 26.12.1, 24.22.1 or 22.23.4 or later.
• If your application still uses the deprecated grpc npm package, migrate to @grpc/grpc-js.

Google Cloud Security Bulletin: GCP-2026-075.

This issue is locked. Please open a new issue for questions.