Bun 1.4.4 removes compromised eMudhra certs

Code

Issues3.5k (3.5k)

Pull requests5k+ (5k+)

Discussions

Actions

Security and quality1 (1)

Insights

More items

bun

Security

Advisories

GHSA-26q8-h657-pf84

Bundled root certificates trust compromised eMudhra (emSign) intermediate CAs

High

alii published GHSA-26q8-h657-pf84 Oct 23, 2026

Package

npm

bun (npm)

Affected versions

< 1.4.4

Patched versions

1.4.4

Description

Summary

Bun's bundled root certificates included emSign ECC Root CA - G3. Eight eMudhra (emSign) intermediate CAs were revoked for key compromise in October 2026, and the six of them that issue TLS certificates chain to that root. Bun 1.4.3 and earlier accept certificates issued by those intermediates. The private keys have been independently recovered by multiple people and some have been disclosed publicly, so any attacker in the network path can impersonate any TLS server to Bun.

Bun 1.4.4 removes the root from the bundle and rejects any certificate chain that contains one of the eight compromised public keys.

This is a compromise of a certificate authority's keys, not a bug in Bun's certificate validation. Other projects that ship their own trust store were affected in the same way.

Any TLS client connection that uses Bun's default trust store is affected. That includes fetch, bun install, bun add, bunx, node:https, node:tls, WebSocket, Bun.connect and fetch over HTTP/3.

A TLS server that sets requestCert: true without a ca also verifies client certificates against the default trust store, so it is affected in the same way.

Bun checks revocation only against a CRL passed in the crl option, so the CA's revocation of the intermediates does not protect affected versions by default.

Executables built with bun build --compile embed the Bun runtime and its trust store. An executable built with an affected version stays affected until it is rebuilt.

An attacker in the network path can present a forged certificate that Bun accepts as valid for any hostname. They can then read and modify the traffic. For bun install and bunx this includes the packages that are downloaded.

Upgrade to Bun 1.4.4, and rebuild any bun build --compile executables with it.

There is no process-wide workaround for affected versions.