The build environments for Cloudflare Workers and Pages have been refreshed to include updated CA certificates, Node.js 22.23.4 and 24.22.1, Bun 1.4.4, and pip 26.2.2. The key security change is the removal of trust for the eight compromised eMudhra intermediate CAs, which could otherwise be used to forge certificates for any hostname.
What Changed in the Build Images
The new images replace the previous CA bundle with a version that no longer contains the compromised eMudhra intermediates. Runtime versions were also bumped: Node.js now runs 22.23.4 and 24.22.1, Bun is at 1.4.4, and pip is at 26.2.2. For older runtimes that still reference the system CA store, environment variables such as SSL_CERT_FILE, PIP_CERT, REQUESTS_CA_BUNDLE, and the --use-bundled-ca flag in NODE_OPTIONS are set to point at the patched bundle.
Why It Matters for CI/CD Security
When a build process clones a repository or fetches dependencies over HTTPS, it relies on the trusted CA set to validate server certificates. If the compromised eMudhra intermediates remain trusted, an attacker could present a forged certificate and intercept or tamper with code, binaries, or configuration files. By rejecting those certificates, the updated images close a vector that could affect any project that performs network calls during a build, including AI model fetches, container image pulls, or secret retrieval.
Operational Impact and Configuration Checks
Most projects will continue to work without modification. However, practitioners should verify three conditions:
- If a custom
BUN_VERSIONis set below1.4.4, the older Bun runtime may still trust the compromised CAs. Update the version or rely on the default. - If the build overrides
SSL_CERT_FILE,PIP_CERT,REQUESTS_CA_BUNDLE, or adds--use-bundled-catoNODE_OPTIONS, ensure the referenced bundle does not include the compromised intermediates. - Tools that bundle their own CA stores (e.g., language-specific package managers) should be upgraded to versions that have removed the eMudhra intermediates.
After updating, run a quick verification step such as openssl s_client -connect example.com:443 -CAfile /path/to/ca-bundle.crt to confirm that the compromised chain is no longer accepted.
Related CloudNinjas coverage: hands-on guides.
What This Means For Practitioners
Adopt the new build images as soon as possible and audit any custom CA configurations in your CI/CD pipelines. Ensure that all tooling that ships its own certificates is updated to a version that excludes the compromised eMudhra intermediates. By doing so, you maintain the integrity of code and dependency fetches, reducing the risk of supply‑chain attacks that exploit forged TLS certificates.
