Workers, Pages - Workers Builds and Pages build images reject compromised eMudhra certificates

The private keys of eight eMudhra intermediate certificate authorities ↗︎ can be recovered, so anyone can forge a certificate for any hostname that chains to them. The Workers Builds and Pages build images now reject these certificates when your build clones your repository, installs dependencies, or makes HTTPS requests.

The updated images include patched CA certificates, Node.js 22.23.4 and 24.22.1, Bun 1.4.4, and pip 26.2.2. Build commands also run with environment variables that point older runtimes at the patched CA certificates.

What you need to do

Most projects need no changes. Update your project if:

• You set BUN_VERSION below 1.4.4. Older Bun versions trust the compromised certificates.
• You set your own SSL_CERT_FILE, PIP_CERT, or REQUESTS_CA_BUNDLE, or set --use-bundled-ca in NODE_OPTIONS. Make sure your CA certificates do not trust the compromised intermediates.
• Your build installs tools that ship their own CA certificates. Update them to a version that removes the compromised intermediates.

For details, refer to the build image documentation for Workers Builds and Pages.