Workers, Pages - Workers Builds and Pages build images reject compromised eMudhra certificates

<p>The private keys of <a href="https://blog.cloudflare.com/emudhra-certificate-compromise/" target="_blank" rel="noopener">eight eMudhra intermediate certificate authorities<span class="external-link"> ↗︎</span></a> can be recovered, so anyone can forge a certificate for any hostname that chains to them. The Workers Builds and Pages build images now reject these certificates when your build clones your repository, installs dependencies, or makes HTTPS requests.</p> <p>The updated images include patched CA certificates, Node.js 22.23.4 and 24.22.1, Bun 1.4.4, and pip 26.2.2. Build commands also run with <a href="https://developers.cloudflare.com/workers/ci-cd/builds/build-image/#trusted-certificates">environment variables</a> that point older runtimes at the patched CA certificates.</p> <div tabindex="-1" class="heading-wrapper level-h4"><h4 id="what-you-need-to-do">What you need to do</h4><a class="anchor-link" href="#what-you-need-to-do"><span aria-hidden="true" class="anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span></a></div> <p>Most projects need no changes. Update your project if:</p> <ul> <li>You set <code>BUN_VERSION</code> below <code>1.4.4</code>. Older Bun versions trust the compromised certificates.</li> <li>You set your own <code>SSL_CERT_FILE</code>, <code>PIP_CERT</code>, or <code>REQUESTS_CA_BUNDLE</code>, or set <code>--use-bundled-ca</code> in <code>NODE_OPTIONS</code>. Make sure your CA certificates do not trust the compromised intermediates.</li> <li>Your build installs tools that ship their own CA certificates. Update them to a version that removes the compromised intermediates.</li> </ul> <p>For details, refer to the build image documentation for <a href="https://developers.cloudflare.com/workers/ci-cd/builds/build-image/">Workers Builds</a> and <a href="https://developers.cloudflare.com/pages/configuration/build-image/">Pages</a>.</p>