fix(tls): distrust compromised eMudhra certificate authorities by bartlomieju · Pull Request #37046 · denoland/deno

bartlomieju · 2026-10-20T18:25:01Z

Updates the bundled Mozilla CA certificates and TLS verifier following the eMudhra intermediate CA key compromise.

Require rustls-webpki 0.103.16, which rejects certificate paths containing the eight compromised public keys, including cross-signed certificates.
Require webpki-roots and webpki-root-certs 1.0.10, removing emSign ECC Root CA - G3 from both bundled root representations.
Update the transitive webpki-roots 0.26 dependency to the 0.26.11 compatibility wrapper so reqwest and hyper-rustls also use the fixed 1.0.10 bundle.
Refresh the lockfile, including the AWS-LC and pkg-config updates required by the verifier.
Require AWS-LC 1.18.2 and migrate ML-DSA imports to its stable signature API, using to_pkcs8v1() to preserve the existing PKCS#8 export format and avoid deprecation errors in CI.

Related upstream fixes: rustls/webpki#546 and rustls/webpki-roots#133.

Validation:

deno run -A tools/format.js --check
cargo check --locked -p deno_tls -p deno_node --features deno_core/v8
cargo clippy --locked -p deno_crypto --features deno_core/v8 -- -D warnings (Rust 1.95.0)
rustfmt --check --edition 2024 ext/crypto/mldsa.rs
Full workspace checks run in CI.
git diff --check
cargo check --locked -p deno_graph

AI assistance: Codex helped investigate the dependencies, update the manifests and lockfile, and prepare this PR.

Bump deno_graph to 0.111.1, which includes the merged TLS dependency update from denoland/deno_graph#670.

CertainLach · 2026-10-20T19:18:24Z

 "wasm-streams",
 "web-sys",
- "webpki-roots",
+ "webpki-roots 0.26.11",


Note that reqwest used by deno_graph is still using the outdated webpki_roots
We can assume that this is safe, as there is only one version of rustls in the graph, thus there won't be two different crypto providers with different certificate sets, and the primary one is initialized in deno's cli/lib, but update to rustls might cause trusted CA store used by reqwest (and thus deno_graph) to diverge

~~It also means that the downloads performed by @deno/loader would still be affected~~
(Actually, not sure about that one, does reqwest perform certificate validation on its own if build with js backend on node, or does it delegate everything to fetch()?)

Reqwest can now be unpinned across the crate graph, as this fix from littledivy this pin was waiting for (seanmonstar/reqwest#2080) was merged in seanmonstar/reqwest#2185

Actually, I might have misread the dependency graph here, the one who is still pulling old webpki-roots is hyper-rustls, not reqwest
The fact is some of the dependencies still pull outdated roots

Thanks, it was only a test dep, but I did a release for good measure

Thanks, it was only a test dep, but I did a release for good measure

Old webpki-roots are still in your Cargo.lock, I'm just unsure why if not deno_graph, I can look into that tomorrow, but it is not completely fixed in this PR

(cherry picked from commit 9766cc5)

… own Deno Java runtimes' cacerts (JKS or PKCS#12, read without keytool), the distribution's Java store, an image's JAVA_HOME and any keystores named in the new keystores argument are matched by public key like PEM bundles. A usage stays exposed until the runtime's blocked.certs refuses every reachable copy of an intermediate for it. Electron apps are found under the usual install roots and their Electron version compared with 42.11.16, 43.8.1 and 44.9.1. The Deno swamp runs on (and any deno on PATH) counts as exposed: the rustls-webpki and webpki-roots fixes are on Deno's main branch (denoland/deno#37046) but in no release yet, and DENO_TLS_CA_STORE=system doesn't help. Run on a Windows 11 host and an eclipse-temurin:21-jre image.

KingTW01

H

…ompromised eMudhra CAs (swamp-club#3699) (#3262) ## Summary Fixes swamp-club#3699. A swamp binary built on Deno 2.9.7 still trusts the compromised eMudhra certificate authorities: the trust store is compiled into both the `denort` runtime the CLI runs on and the copy of Deno it embeds for extensions. That leaves swamp's HTTPS/WSS traffic (S3 datastores, GitHub, 1Password, swamp-club, `--server`, extension HTTP calls) open to interception by anyone holding one of the recovered intermediate keys. Deno 2.9.8 (released 2026-10-21) ships denoland/deno#37046: - `rustls-webpki` 0.103.16 rejects certificate paths that include any of the eight compromised intermediate public keys, cross-signed copies included. - `webpki-roots` / `webpki-root-certs` 1.0.10 drop `emSign ECC Root CA - G3` from the bundled Mozilla roots. ## Change - `.tool-versions`: `deno 2.9.7` → `deno 2.9.8` - `Dockerfile`: `FROM denoland/deno:2.9.7` → `FROM denoland/deno:2.9.8` `release.yml` needs no edit. Its setup-deno step, and every other workflow that installs Deno, reads `.tool-versions` through `deno-version-file`. `scripts/download_deno.ts` already fails a CI compile when the running Deno doesn't match the pin, so released binaries take both `denort` and the embedded `deno` from 2.9.8. ## Test Plan - [x] verify-build on host Deno 2.9.8 (lint, fmt, type check, full test suite, vuln scan, compile, binary check), plus verify-reviews and verify-skills. Attestation `57b3813a-e10f-45c3-92e9-867517a53d70`. - [x] Deno 2.9.8 is listed in `dl.deno.land/versions.json`, has a GitHub release and is on Docker Hub as `denoland/deno:2.9.8`, so setup-deno and the Docker build resolve. - [x] The `deno` and `denort` zips for all five release targets return 200 on both GitHub releases and `dl.deno.land`. - [x] Release-style compile in a Linux container (`CI=true`, host Deno 2.9.8): every `deno`/`denort` download came from the 2.9.8 release, and a compiled probe reported runtime `2.9.8`. - [x] `integration/toolchain_pins_rules_test.ts` passes (the `Dockerfile` and every setup-deno step match `.tool-versions`). - Not reproduced end to end: `www.emsign.com` chains to `emSign Root CA - G1`, which isn't on the distrust list, so it loads on both 2.9.7 and 2.9.8. The disclosure test hosts from the issue are redacted, so whether the fix is in rests on the upstream dependency bumps. To check a released binary, the embedded Deno it extracts reports itself as 2.9.8: run `~/.swamp/deno/deno --version`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_015Ai7cWZ3kCLTa7R1esN1XX Co-authored-by: Blake Irvin <blakeirvin@me.com> Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2.9.8 is the first release that stops trusting the leaked eMudhra intermediate CA (rustls-webpki 0.103.16 / webpki-roots 1.0.10, denoland/deno#37046). The Docker base image stays digest-pinned to the multi-arch index for denoland/deno:2.9.8. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Deno 2.9.8 retire de son magasin racine les autorités de certification eMudhra compromises (denoland/deno#37046).

….2.4 (#100) 2.9.8 distrusts the eight eMudhra intermediate CAs whose private keys were recovered and published (denoland/deno#37046); ocsp-leaf calls Cloud KMS over TLS to sign responses. Bumps ocsp-leaf to 0.2.4 for the release tag; no behaviour change.

Deno 2.9.8 is the first release whose certificate path verification rejects the compromised eMudhra / emSign intermediates (denoland/deno#37046: rustls-webpki rejects paths through the eight compromised keys, cross-signed ones included, and webpki-roots drops emSign ECC Root CA - G3). Deno 2.7.14 accepts certificates chaining to them, and Quarto's launchers force DENO_TLS_CA_STORE=system,mozilla, so no store setting protects `quarto publish`, `quarto add` or the tool installers. 2.9.7 and earlier lack the fix, so 2.9.8 is the minimum (#15152). The runtime migration plans also target the 2.9 line for Deno's Node compatibility work (node:http upgrade handling, Node 26 targets); those fixes were not checked against 2.7.14.

bartlomieju added 2 commits October 20, 2026 20:22

fix(tls): distrust compromised eMudhra certificate authorities

2ed9bea

fix(crypto): use stable AWS-LC ML-DSA APIs

9787a28

CertainLach mentioned this pull request Oct 20, 2026

fix: update webpki roots are-we-dodo-yet/dodo#14

Merged

CertainLach reviewed Oct 20, 2026

View reviewed changes

bartlomieju mentioned this pull request Oct 20, 2026

fix: update TLS roots and verifier after eMudhra compromise denoland/deno_graph#670

Merged

chore: bump deno_graph to 0.111.1

5967dcf

bartlomieju enabled auto-merge (squash) October 20, 2026 20:26

bartlomieju merged commit 9766cc5 into main Oct 20, 2026
136 checks passed

bartlomieju deleted the fix/emudhra-ca-distrust branch October 20, 2026 21:36

bryan-minimal mentioned this pull request Oct 20, 2026

SECURITY: deno, claude-code: default to the system trust store (CVE-2026-111943) gominimal/pkgs#956

Merged

bartlomieju added a commit that referenced this pull request Oct 21, 2026

fix(tls): distrust compromised eMudhra certificate authorities (#37046)

1ade678

(cherry picked from commit 9766cc5)

KingTW01 reviewed Oct 21, 2026

View reviewed changes

stack72 mentioned this pull request Oct 21, 2026

fix(runtime): build and release swamp on Deno 2.9.8 to distrust the compromised eMudhra CAs (swamp-club#3699) swamp-club/swamp#3262

Merged

5 tasks done

petamoriken mentioned this pull request Oct 21, 2026

Add Deno galadran/we-have-a-problem.com#63

Merged

jonathanfallon mentioned this pull request Oct 21, 2026

fix(api): monte Deno en 2.9.8 (CA eMudhra compromises) covoiturage-gouv-fr/mono#3631

Merged

mya-ake mentioned this pull request Oct 21, 2026

chore(deno): upgrade runtime 2.8.3 → 2.9.8 across image and CI mya-ake/portfolio#1217

Merged

jonathanfallon added a commit to covoiturage-gouv-fr/mono that referenced this pull request Oct 21, 2026

fix(api): monte Deno en 2.9.8 (CA eMudhra compromises) (#3631)

3df99d6

Deno 2.9.8 retire de son magasin racine les autorités de certification eMudhra compromises (denoland/deno#37046).

stupleb mentioned this pull request Oct 22, 2026

fix: distrust the compromised eMudhra CA; 6.4.1:1 → 6.4.1:2 stupleb/blossom-server-startos#7

Merged

This was referenced Oct 22, 2026

Bundled Deno 2.7.14 still trusts the compromised eMudhra/emSign intermediates (fixed in Deno 2.9.8) quarto-dev/quarto-cli#15152

Open

Update bundled Deno from 2.7.14 to 2.9.x quarto-dev/quarto-cli#15157

Open

boojamya mentioned this pull request Oct 22, 2026

build(ocsp-leaf): Deno 2.9.8 base image (eMudhra distrust), release 0.2.4 wholeearthlabs/realreel-c2pa#100

Merged

cderv mentioned this pull request Oct 23, 2026

Update Deno to 2.9.8 for the eMudhra certificate distrust quarto-dev/quarto-cli#15186

Open

3 of 5 tasks

Navigation Menu

Repository navigation

fix(tls): distrust compromised eMudhra certificate authorities - #37046

fix(tls): distrust compromised eMudhra certificate authorities#37046
bartlomieju merged 3 commits into
mainfrom
fix/emudhra-ca-distrust

bartlomieju commented Oct 20, 2026 •

edited

Loading

Uh oh!

CertainLach Oct 20, 2026 •

edited

Loading

Uh oh!

CertainLach Oct 20, 2026 •

edited

Loading

Uh oh!

CertainLach Oct 20, 2026 •

edited

Loading

Uh oh!

bartlomieju Oct 20, 2026

Uh oh!

CertainLach Oct 20, 2026

Uh oh!

Uh oh!

KingTW01 left a comment

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

bartlomieju commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

CertainLach Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

CertainLach Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

CertainLach Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bartlomieju Oct 20, 2026

Choose a reason for hiding this comment

Uh oh!

CertainLach Oct 20, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

KingTW01 left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

bartlomieju commented Oct 20, 2026 •

edited

Loading

CertainLach Oct 20, 2026 •

edited

Loading

CertainLach Oct 20, 2026 •

edited

Loading

CertainLach Oct 20, 2026 •

edited

Loading