---
title: >-
  nginx, Node.js, eMudhra October 2026: our apps
description: >-
  nginx 1.30.6 advisories, Node.js 22.23.4 and the eMudhra emSign CA
  compromise checked against every Workflow app for Shopify. Nothing for
  merchants to do.
source_url:
  html: >-
    https://docs.codecreationlabs.app/blog/nginx-nodejs-emudhra-october-2026-status
  md: >-
    https://docs.codecreationlabs.app/blog/nginx-nodejs-emudhra-october-2026-status.md
---

# nginx, Node.js and the eMudhra certificate compromise: status of our apps

October 2026 brought three security events that concern the servers behind Shopify apps: the nginx security release of 14 October, the Node.js security release of 21 October and the eMudhra (emSign) certificate authority compromise disclosed on 20 October. Several agencies asked us about them on behalf of their clients, so here is the answer for every app we make: Workflow Trigger Extensions, Workflow Webhooks, Workflow Transactional Email, Workflow Functions, Workflow Suite, Workflow Forms and Workflow Documents.

**In short: nothing to do on your side.** Node.js is patched, the nginx issues cannot be reached with our configuration, none of our systems trusts the compromised certificates, and none of our own certificates comes from eMudhra.

## Node.js (CVE-2026-111497 and nine further CVEs, 21 October)

Our apps are TypeScript on Node.js, so this release concerned us directly. Every app was rebuilt on the fixed release **Node.js 22.23.4** and redeployed. The version is pinned in every container image, so a rebuild can never fall back to an older release, and we confirmed 22.23.4 in every production service.

## nginx (CVE-2026-15176, CVE-2026-93479, CVE-2026-97205, CVE-2026-95101, CVE-2026-97629, 14 October)

nginx is not part of our applications. It runs only as the Kubernetes ingress in front of them, the component that terminates TLS and forwards each request to the app. We checked each of the five advisories against the configuration it actually runs:

| Advisory | Precondition | Our ingress |
| --- | --- | --- |
| CVE-2026-15176, buffer overflow with `alias` and `rewrite` | A location that combines `alias` with `rewrite` | **Not reachable.** No `alias` and no `rewrite` anywhere; the ingress serves no files, it only forwards requests. |
| CVE-2026-93479, buffer overflow in script evaluation | nginx 1.30.0 to 1.30.5 or 1.31.2 to 1.31.6 | **Not affected.** Our nginx is outside these versions. |
| CVE-2026-97205, use-after-free with asynchronous file I/O | Server-side includes (SSI) with `include virtual` | **Not reachable.** SSI is not enabled. |
| CVE-2026-95101, request body injection in HTTP/3 | HTTP/3 (QUIC) enabled | **Not reachable.** HTTP/3 is not enabled; the ingress speaks HTTP/1.1 and HTTP/2 only. |
| CVE-2026-97629, session forgery with TLS session tickets | TLS session tickets enabled | **Not reachable.** Session tickets are switched off. |

The apps behind the ingress verify every request themselves (Shopify session tokens, Shopify's HMAC signature on webhooks and app proxy requests), so the ingress is never the only line of defence.

## eMudhra (emSign) certificate authority compromise (20 October)

The private keys of eight eMudhra intermediate certificate authorities can be recovered from their public certificates, and Mozilla removed **emSign ECC Root CA - G3** from its trust store (NSS 3.131.1). We checked both directions:

- **Who we trust (outbound connections).** Our apps make outbound HTTPS calls from Node.js, which uses its own built-in list of trusted roots. On Node.js 22.23.4 that list follows the updated Mozilla store and **does not contain emSign ECC Root CA - G3**. The operating system bundle in our app images (Alpine Linux, ca-certificates 20261020) does not contain it either, and no app adds extra roots. There is no Python, Go or Java in our app containers. The PDF renderer of Workflow Documents is built on Debian, whose package still listed the root, so we removed it from that image as well.
- **Who trusts us (our own certificates).** None of our certificates chains to an eMudhra or emSign root. Our domains use certificates from Let's Encrypt, Google Trust Services and Cloudflare.
- **Certificate Transparency.** On 28 October we searched the public Certificate Transparency logs for every certificate ever issued for our domains (the app domains, their help centers and our company domains, several hundred certificates in total). **Not one was issued by eMudhra or emSign.** Nobody can have used the compromised intermediates to impersonate our apps.

## Checks for signs of compromise

- Every container running in our production cluster comes from our own private image registry or from the official Google, Kubernetes and cert-manager registries. We found no unknown workload or process.
- App containers are rebuilt from source for every release and replaced, not patched in place.
- We reviewed every route, data path and database query of every app on 18 October and ran Shopify's app security checks against every app on 23 and 26 October.
- After the PHP2Shell disclosure we reviewed our access logs: the only related traffic was routine background scanning, and every such request was answered with a 404.

## Credentials and access tokens

None of these issues gave anyone access to our systems, so no credential had to be replaced. **You do not need to reinstall any app or change anything.** Your store's Shopify access token is a short-lived, expiring token, encrypted individually with a key in Google Cloud KMS, and is never written to logs.

More on how the apps are built, hosted and kept up to date is on [Security at Code Creation Labs](https://docs.codecreationlabs.app/security.md). If you need this confirmed in writing for a security questionnaire, email support@codecreationlabs.com.