---
type: "post"
id: "workers-builds-and-pages-build-images-reject-compromised-134fd7"
slug: "workers-builds-and-pages-build-images-reject-compromised-134fd7"
title: "Workers Builds and Pages build images reject compromised eMudhra certificates"
description: "Cloudflare says Workers Builds and Pages build images now reject certificates chaining to eight compromised eMudhra intermediate authorities."
retrieval_nugget: "Cloudflare says Workers Builds and Pages build images now reject certificates chaining to eight compromised eMudhra intermediate authorities. The change covers repository cloning, dependency installation and HTTPS requests during builds, while customers with pinned older runtimes or custom certificate bundles may still need to check their configuration."
published_at: "2026-11-06"
updated_at: "2026-11-06"
record_date: "2026-11-06"
date_kind: "published_at"
topics: ["security","developer-tools"]
entities: ["Cloudflare","Workers Builds","Cloudflare Pages","eMudhra","Bun","Node.js","pip"]
related_patterns: ["agent-security-moves-to-runtime-boundaries"]
novelty_label: "new_fact"
what_changed: "Cloudflare now rejects compromised eMudhra certificates in Workers Builds and Pages build images, with updated CA bundles and runtime versions."
prior_refs: []
source_url: "https://developers.cloudflare.com/changelog/post/2026-10-23-build-images-emudhra-certificates"
source_urls: ["https://developers.cloudflare.com/changelog/post/2026-10-23-build-images-emudhra-certificates"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:workers-builds-and-pages-build-images-reject-compromised-134fd7"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/workers-builds-and-pages-build-images-reject-compromised-134fd7/","markdown":"https://newruntime.com/posts/workers-builds-and-pages-build-images-reject-compromised-134fd7.md","json":"https://newruntime.com/posts/workers-builds-and-pages-build-images-reject-compromised-134fd7.json"}
markdown_url: "https://newruntime.com/posts/workers-builds-and-pages-build-images-reject-compromised-134fd7.md"
---

# Workers Builds and Pages build images reject compromised eMudhra certificates

## Retrieval answer

Cloudflare says Workers Builds and Pages build images now reject certificates chaining to eight compromised eMudhra intermediate authorities. The change covers repository cloning, dependency installation and HTTPS requests during builds, while customers with pinned older runtimes or custom certificate bundles may still need to check their configuration.

## Summary
Cloudflare says Workers Builds and Pages build images now reject certificates chaining to eight compromised eMudhra intermediate authorities. The change covers repository cloning, dependency installation and HTTPS requests during builds, while customers with pinned older runtimes or custom certificate bundles may still need to check their configuration.

## What happened
In a changelog entry dated October 23, 2026, Cloudflare describes a change to the build images used by Workers Builds and Pages. The company says private keys for eight eMudhra intermediate certificate authorities can be recovered. A party able to use those keys could forge a certificate for any hostname that chains to the affected authorities. Cloudflare’s update is to reject those certificates in its build images, so the affected trust chain is not accepted during build activity.

The stated protection covers several ordinary build operations: cloning a repository, installing dependencies and making HTTPS requests. These are points at which a build environment may connect to remote services and rely on its certificate trust store to authenticate them. The announcement describes the change as applying to Workers Builds and Pages build images; it does not claim that every environment running customer code, or every Cloudflare product, is covered by this update.

Cloudflare lists the components included in the updated images: patched CA certificates, Node.js 22.23.4 and 24.22.1, Bun 1.4.4, and pip 26.2.2. It also says build commands run with environment variables that point older runtimes at the patched CA certificates. These details matter because a build can use a runtime or package-management tool whose certificate handling differs from the base image’s defaults.

Cloudflare says most projects need no changes. It identifies exceptions: projects that set `BUN_VERSION` below 1.4.4; projects that set their own `SSL_CERT_FILE`, `PIP_CERT` or `REQUESTS_CA_BUNDLE`, or use `--use-bundled-ca` in `NODE_OPTIONS`; and builds that install tools shipping their own CA certificates. For those cases, the company says to ensure the certificates do not trust the compromised intermediates and to update tools whose bundled certificates still include them. The source points readers to its build image documentation for further detail, but gives no pricing, rollout schedule or broader migration timetable.

## What the archive adds
This is a new operational detail on a known certificate-compromise story. Our earlier note on [the eMudhra advisory](https://newruntime.com/posts/emudhra-security-advisory-eight-intermediate-ca-keys-were-bb9034/) records the recoverable keys and the remaining exposure in self-managed environments. A later [Cloudflare account](https://newruntime.com/posts/emudhra-private-key-compromise-of-intermediate-certificates-393022/) describes Cloudflare’s response and evidence of attempted exploitation. This changelog specifies protections in Workers Builds and Pages images and the configurations that may need attention.

## Trend signal
No supplied SITE_PATTERNS thesis directly fits this update. It is a specific certificate-trust remediation, not evidence for a broader agent-system pattern.

## Why now
The timing follows the disclosure that the private keys of eight eMudhra intermediate authorities could be recovered. Cloudflare’s stated response is to change the certificate trust behavior of managed build images where repository and dependency retrieval commonly occur. The source does not give a separate rollout date or explain why these component versions were selected beyond their inclusion in the updated images.

## Connections to other events
The related archive record describes a broader response to the same eMudhra compromise: Vercel updated managed infrastructure and runtimes while identifying self-managed runtimes and Node.js 20.x as exposure requiring action. Cloudflare’s changelog addresses a more bounded layer: the build-image trust path used by Workers Builds and Pages. Both accounts distinguish managed defaults from configurations customers still control.

## Why it matters
Build systems routinely fetch source, packages and other HTTPS resources, so their trust configuration is part of the software supply chain. Cloudflare’s change makes the default build-image behavior safer for these particular certificates, reducing the chance that a forged certificate in the affected chain is accepted during the listed operations. But a platform default does not automatically repair every trust store used by a project.

Teams that override CA paths, pin an older Bun version, or install tools with their own certificate bundle should treat those choices as separate trust boundaries. A package installer, runtime flag, or embedded CLI can use certificates differently from the image that hosts it. For teams building AI products, this matters as much for model-provider and package downloads as for ordinary application dependencies: automated pipelines make many outbound requests without a person seeing each connection. The practical lesson is to know which certificate store each build step actually uses, rather than assuming that an image-level patch reaches every bundled tool.

## Limits and uncertainty
The changelog does not identify the eight intermediates by name, explain how the patched CA bundle was validated, or quantify how many builds or customers were exposed. It does not establish whether any Cloudflare customer build accepted a forged certificate before the change, nor whether customer workloads outside these build images are protected. The instructions identify configurations that may need review but do not enumerate every tool that ships its own CA store.

Cloudflare also does not specify whether every older runtime receives identical environment-variable treatment, or how projects can audit a nested tool’s certificate source from the changelog alone. Teams should consult Cloudflare’s build-image documentation and inspect their own build configuration rather than infer universal coverage from the announcement.

## Skill to build now
Make certificate trust provenance a build-pipeline check. This week, inventory whether your build sets `SSL_CERT_FILE`, `PIP_CERT`, `REQUESTS_CA_BUNDLE`, `NODE_OPTIONS`, or a runtime version such as `BUN_VERSION`. Then list package managers and installed build tools that carry their own CA bundle. For each build step that contacts an HTTPS endpoint, record which trust store it uses and whether it inherits the platform image’s patched certificates. That simple map turns a vendor-managed mitigation into a reviewable control rather than an assumption.

## Reader takeaway
Cloudflare has added a targeted trust-store defense to Workers Builds and Pages, and says most projects need no changes. The exception is customization: pinned older Bun, overridden CA-bundle settings, or tools with bundled certificates can bypass the image’s patched defaults. Check those points in your build pipeline instead of assuming one platform update covers them all.

## Open question
How can teams reliably identify every dependency-install or build tool that uses a certificate bundle separate from the patched base image?

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Security](https://newruntime.com/topics/security.md): Explore the security topic hub.
- topic hub: [Developer Tools](https://newruntime.com/topics/developer-tools.md): Explore the developer-tools topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Sources](https://newruntime.com/sources/): See the original sources this archive cites.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)