[Important Notice] Critical Vulnerabilities in PHP and Node.js, and the eMudhra Intermediate CA Key Leak

2026-10-23 · maintenance

Four security issues that require action were published between 20 and 21 October.

Leak of intermediate CA keys of the certificate authority eMudhra (emSign)
Vulnerability in Node.js
Vulnerability in PHP
Vulnerability in Apache Tomcat

Issue 1 affects all users. Please consider the actions under 1. [What to do].
If you use Node.js, please consider the actions under 2. [What to do] for issue 2.

For each issue, please see the details below.

1. Leak of intermediate CA keys of eMudhra (emSign)

[Overview]

For eight intermediate certificates of the certificate authority operated by eMudhra, a third party was able to create genuine certificates that impersonate any website.
With them, an attacker can impersonate any website and tamper with its content.
Software that has not been updated shows no warning when it connects to a fake site, so eavesdropping on or tampering with the communication cannot be detected.

[What to do]

Update your OS to the latest version and restart your PC (Windows Update, macOS Software Update).
Update your browser (Chrome, Firefox, Edge, Safari) to the latest version and restart it.

[What to do if you have installed Python, conda, R or git in your home area or elsewhere on the NIG supercomputer]

If you use pip, run the following command.

$ pip install --upgrade pip certifi

If you use conda, run the following command in each environment.

$ conda update ca-certificates certifi

If you use uv, update it to version 0.13.4 or later.

[How to check]

Connect to the following URL. If you get a certificate error, the action has taken effect. If the page is displayed normally, the actions above may not be complete.

To open it in a browser:

https://dv-g3b-emudhra.we-have-a-problem.com/

To check on the command line:

$ curl https://dv-g3b-emudhra.we-have-a-problem.com/

If you use Python, also confirm that the following command ends with an error.

$ python3 -c "import urllib.request; urllib.request.urlopen('https://dv-g3b-emudhra.we-have-a-problem.com/')"

2. Vulnerability in Node.js

[Overview]

A Node.js program can have arbitrary code executed by a malicious server merely by connecting to an external server and receiving its response.
Not only programs published as web servers are affected, but also scripts and tools that fetch external APIs or web pages.

[Who is affected]

Users who have installed Node.js in their home area or elsewhere on the NIG supercomputer.

[What to do]

Check your Node.js version with the following command.
```
$ node -v
```
Update to one of the fixed versions: 22.23.4, 24.22.1 or 26.12.1.
Fixed versions are released only for the 22.x, 24.x and 26.x lines. If you use any other version, move as follows.
- If you use 25.x, move to 26.12.1.
- If you use 23.x, move to 24.22.1.
- If you use 21.x, 20.x or earlier, move to 24.22.1 or 26.12.1.
Support for 22.x is scheduled to end in April 2027, so we do not recommend it as a new destination.
For containers that include Node.js, pull the latest base image again and rebuild without using the cache.

3. Vulnerability in PHP

[Overview]

A web server running on PHP can be taken over from outside without authentication.

4. Vulnerability in Apache Tomcat

[Overview]

In systems that use Apache Tomcat, information may be leaked or tampered with in communication over HTTP/2, and unauthorized access that abuses the authentication function may occur.

References

Last updated: 2026-10-23