Node.js will reject TLS chains that use any of the 8 compromised eMudhra (emSign) intermediate keys, ported from Electron and matching Go and the blocks Chrome and Firefox already ship. Blocks by public key, so reissued certs don't get through.
XFEDI
ActivityPubConversation
A reasonable question came up: isn't the root removal enough? The answer depends on which trust store you use. The script below lets anyone check it in a minute, in a throwaway container, using only public data
https://gist.github.com/UlisesGascon/10ed0724930e5382b3ed48fa2b0d3e02
GisteMudhra/emSign Oct 2026 intermediate compromise: what a root store update covers (reproducible check)eMudhra/emSign Oct 2026 intermediate compromise: what a root store update covers (reproducible check) - README.md