From 6461afe09de652a2412bb66c3ba02cfab15bc2b3 Mon Sep 17 00:00:00 2001 From: Naresh Date: Wed, 21 Oct 2026 19:15:48 +0100 Subject: [PATCH 1/6] [Sandbox] Announce the eMudhra fix in 0.12.13 The private keys of eight eMudhra intermediate CAs can be recovered, and Sandbox SDK images up to 0.12.12 trust certificates that chain to them. In the 0.12.13 images, the CA bundle, Node.js, cloudflared, and pip reject those certificates, and 0.x users get that only by moving both the package and the image to 0.12.13. 1.x has no release to update to: the user's own image decides what sandboxes trust, so those users need to rebuild it. The entry tells both groups what to do. Bun checks certificates against its own built-in list, so the entry also gives workarounds for `bun`, OpenCode, and large backups until a release updates Bun. --- .../sandbox/2026-10-22-emudhra-certificates.mdx | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 src/content/changelog/sandbox/2026-10-22-emudhra-certificates.mdx diff --git a/src/content/changelog/sandbox/2026-10-22-emudhra-certificates.mdx b/src/content/changelog/sandbox/2026-10-22-emudhra-certificates.mdx new file mode 100644 index 00000000000..c31c66d0740 --- /dev/null +++ b/src/content/changelog/sandbox/2026-10-22-emudhra-certificates.mdx @@ -0,0 +1,15 @@ +--- +title: Sandbox SDK 0.12.13 updates trusted certificates after the eMudhra compromise +description: In Sandbox SDK 0.12.13 images, the CA bundle, Node.js, cloudflared, and pip reject certificates from the compromised eMudhra intermediate CAs. Update your package and image to 0.12.13. +products: + - sandbox +date: 2026-10-22 +--- + +The private keys of [eight eMudhra intermediate certificate authorities](https://blog.cloudflare.com/emudhra-certificate-compromise/) can be recovered, so anyone can forge a certificate for any hostname that chains to them. Sandbox SDK images up to 0.12.12 trust these certificates. An HTTPS connection that leaves the container directly, such as one from `mountBucket()`, backups, `gitCheckout()`, tunnels, or code that runs in the sandbox, can be intercepted with a forged certificate. + +In the `docker.io/cloudflare/sandbox:0.12.13` images, the system CA bundle, Node.js, `cloudflared`, and pip reject these certificates. The images ship updated Ubuntu and Alpine CA certificates, Node.js 22.23.4, `cloudflared` 2026.10.2, and pip 26.2.2 in the `-python` image. Update `@cloudflare/sandbox` and the `FROM` line in your `Dockerfile` to 0.12.13, then redeploy. + +The `bun` command, OpenCode (built on Bun), and `createBackup()` uploads of archives of 10 MiB or more check certificates against Bun's built-in CA list rather than the image's. A later release will update Bun. Until then, pass `multipart: false` to [`createBackup()`](/sandbox/sdk/api/backups/#createbackup) to upload with `curl`, which uses the image's CA bundle. For `bun` and OpenCode, set [`interceptHttps = true`](/sandbox/sdk/guides/outbound-traffic/#https-traffic) and add an `outbound` handler that returns `fetch(request)`, so that Cloudflare checks their certificates. + +Sandbox SDK 1.x makes no TLS connections of its own, so your image decides which certificates your sandboxes trust. Pull your base image again and rebuild without the Docker build cache, so your image picks up updated CA certificates and runtimes. From c133b39606680067d8da4665052bc9b7da05f5c9 Mon Sep 17 00:00:00 2001 From: Naresh Date: Thu, 22 Oct 2026 11:55:17 +0100 Subject: [PATCH 2/6] [Sandbox] Lead the eMudhra entry with what to do The entry described what changed in the 0.12.13 images before it said what readers had to do, and it never told anyone when they were done. Put the actions first, under "What you need to do", split by SDK line. 0.x users update the package and image to 0.12.13 now. The Bun workarounds apply only to sandboxes that run bun or OpenCode or upload large backups, and a closing line says the update is otherwise enough. 1.x users rebuild their own image. The list of updated components moves to the end. The description now names 0.x, so 1.x readers aren't told to install 0.12.13. --- .../2026-10-22-emudhra-certificates.mdx | 27 ++++++++++++++++--- 1 file changed, 23 insertions(+), 4 deletions(-) diff --git a/src/content/changelog/sandbox/2026-10-22-emudhra-certificates.mdx b/src/content/changelog/sandbox/2026-10-22-emudhra-certificates.mdx index c31c66d0740..ef1ffc88b9e 100644 --- a/src/content/changelog/sandbox/2026-10-22-emudhra-certificates.mdx +++ b/src/content/changelog/sandbox/2026-10-22-emudhra-certificates.mdx @@ -1,6 +1,6 @@ --- title: Sandbox SDK 0.12.13 updates trusted certificates after the eMudhra compromise -description: In Sandbox SDK 0.12.13 images, the CA bundle, Node.js, cloudflared, and pip reject certificates from the compromised eMudhra intermediate CAs. Update your package and image to 0.12.13. +description: Sandbox SDK images up to 0.12.12 trust certificates from the compromised eMudhra intermediate CAs. If you use Sandbox SDK 0.x, update your package and image to 0.12.13 immediately. products: - sandbox date: 2026-10-22 @@ -8,8 +8,27 @@ date: 2026-10-22 The private keys of [eight eMudhra intermediate certificate authorities](https://blog.cloudflare.com/emudhra-certificate-compromise/) can be recovered, so anyone can forge a certificate for any hostname that chains to them. Sandbox SDK images up to 0.12.12 trust these certificates. An HTTPS connection that leaves the container directly, such as one from `mountBucket()`, backups, `gitCheckout()`, tunnels, or code that runs in the sandbox, can be intercepted with a forged certificate. -In the `docker.io/cloudflare/sandbox:0.12.13` images, the system CA bundle, Node.js, `cloudflared`, and pip reject these certificates. The images ship updated Ubuntu and Alpine CA certificates, Node.js 22.23.4, `cloudflared` 2026.10.2, and pip 26.2.2 in the `-python` image. Update `@cloudflare/sandbox` and the `FROM` line in your `Dockerfile` to 0.12.13, then redeploy. +## What you need to do -The `bun` command, OpenCode (built on Bun), and `createBackup()` uploads of archives of 10 MiB or more check certificates against Bun's built-in CA list rather than the image's. A later release will update Bun. Until then, pass `multipart: false` to [`createBackup()`](/sandbox/sdk/api/backups/#createbackup) to upload with `curl`, which uses the image's CA bundle. For `bun` and OpenCode, set [`interceptHttps = true`](/sandbox/sdk/guides/outbound-traffic/#https-traffic) and add an `outbound` handler that returns `fetch(request)`, so that Cloudflare checks their certificates. +### Sandbox SDK 0.x -Sandbox SDK 1.x makes no TLS connections of its own, so your image decides which certificates your sandboxes trust. Pull your base image again and rebuild without the Docker build cache, so your image picks up updated CA certificates and runtimes. +Update immediately. Install `@cloudflare/sandbox@0.12.13`, change the `FROM` line in your `Dockerfile` to the matching image, and redeploy. Keep any `-python`, `-opencode`, or `-musl` suffix on the image tag. + +```dockerfile title="Dockerfile" +FROM docker.io/cloudflare/sandbox:0.12.13 +``` + +If your sandboxes run `bun` or OpenCode, or `createBackup()` uploads archives of 10 MiB or more, also apply these workarounds until a later release updates Bun. All three check certificates against Bun's built-in CA list rather than the image's. + +- For backups, pass `multipart: false` to [`createBackup()`](/sandbox/sdk/api/backups/#createbackup) to upload with `curl`, which uses the image's CA bundle. +- For `bun` and OpenCode, set [`interceptHttps = true`](/sandbox/sdk/guides/outbound-traffic/#https-traffic) and add an `outbound` handler that returns `fetch(request)`, so that Cloudflare checks their certificates. + +If your sandboxes use none of these, updating to 0.12.13 is all you need to do. + +### Sandbox SDK 1.x + +You do not need to update the SDK, because it makes no TLS connections of its own. Your image decides which certificates your sandboxes trust, so pull your base image again and rebuild it without the Docker build cache to pick up updated CA certificates and runtimes. + +## What changed in 0.12.13 + +In the 0.12.13 images, the system CA bundle, Node.js, `cloudflared`, and pip reject certificates from the compromised intermediates. The images ship updated Ubuntu and Alpine CA certificates, Node.js 22.23.4, `cloudflared` 2026.10.2, and pip 26.2.2 in the `-python` image. From 269f262d397a3e2b8b105690e1ae4f362100933c Mon Sep 17 00:00:00 2001 From: Naresh Date: Thu, 22 Oct 2026 14:09:45 +0100 Subject: [PATCH 3/6] [Sandbox] Give 1.x readers the full image update The 1.x section said to pull the base image and rebuild without the build cache, which is not enough on its own. wrangler deploy builds with the local images and build cache and does not pull, so the steps now say how to refresh both. Running sandboxes keep the image they started with, and a snapshot restores the image it came from, so the section also says to stop running sandboxes and to take new snapshots. Say that a 0.x deployment's rollout replaces running sandboxes, and add a check against the test hosts for both versions. --- .../sandbox/2026-10-22-emudhra-certificates.mdx | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/src/content/changelog/sandbox/2026-10-22-emudhra-certificates.mdx b/src/content/changelog/sandbox/2026-10-22-emudhra-certificates.mdx index ef1ffc88b9e..d6e8d698d10 100644 --- a/src/content/changelog/sandbox/2026-10-22-emudhra-certificates.mdx +++ b/src/content/changelog/sandbox/2026-10-22-emudhra-certificates.mdx @@ -12,7 +12,7 @@ The private keys of [eight eMudhra intermediate certificate authorities](https:/ ### Sandbox SDK 0.x -Update immediately. Install `@cloudflare/sandbox@0.12.13`, change the `FROM` line in your `Dockerfile` to the matching image, and redeploy. Keep any `-python`, `-opencode`, or `-musl` suffix on the image tag. +Update immediately. Install `@cloudflare/sandbox@0.12.13`, change the `FROM` line in your `Dockerfile` to the matching image, and redeploy. Keep any `-python`, `-opencode`, or `-musl` suffix on the image tag. The deployment's [rollout](/containers/configuration/rollouts/) replaces running sandboxes with ones that use the new image. ```dockerfile title="Dockerfile" FROM docker.io/cloudflare/sandbox:0.12.13 @@ -27,7 +27,20 @@ If your sandboxes use none of these, updating to 0.12.13 is all you need to do. ### Sandbox SDK 1.x -You do not need to update the SDK, because it makes no TLS connections of its own. Your image decides which certificates your sandboxes trust, so pull your base image again and rebuild it without the Docker build cache to pick up updated CA certificates and runtimes. +You do not need to update the SDK, because it makes no TLS connections of its own. Your image decides which certificates your sandboxes trust, so rebuild it and replace the sandboxes that run the old one: + +1. Run `docker pull` for each base image in your `Dockerfile`, then clear the Docker build cache with `docker builder prune --all`. `wrangler deploy` builds with your local images and build cache, so without these steps it can ship the old CA certificates and runtimes. If your Wrangler configuration references an image by digest, build and push a new image and update the digest instead. +2. Deploy your Worker. +3. Stop sandboxes that are still running, for example with `this.ctx.container.destroy()`. A running sandbox keeps the image it started with until it stops. To restart only the sandboxes whose image is out of date, refer to [Roll out a named image update](/containers/guides/image-management/#roll-out-a-named-image-update). +4. If you use [snapshots](/containers/guides/snapshots/), create new ones from sandboxes that run the updated image. A snapshot restores the image it was created from, so an older snapshot brings back the old certificates. + +## Check your sandboxes + +From inside a sandbox, connect to one of the test hosts listed at [emudhra.we-have-a-problem.com](https://emudhra.we-have-a-problem.com/) with each TLS client your code uses, such as `curl`, `node`, or `bun`. Every request should fail: + +```sh +curl -f https://dv-g3b-emudhra.we-have-a-problem.com/ +``` ## What changed in 0.12.13 From cc5a2bf0ab9b450e409677ed73f99d324b466a22 Mon Sep 17 00:00:00 2001 From: Naresh Date: Thu, 22 Oct 2026 17:24:48 +0100 Subject: [PATCH 4/6] [Sandbox] Point the eMudhra entry at 0.12.14 0.12.14 updates Bun to 1.4.4, so the `bun` command, OpenCode and large backups no longer need workarounds. The entry now tells 0.x users to update to 0.12.14, or to 0.13.0-next.825.1 on the next prerelease, and says what 0.12.13 and 0.12.14 each changed. --- .../2026-10-22-emudhra-certificates.mdx | 21 ++++++++----------- 1 file changed, 9 insertions(+), 12 deletions(-) diff --git a/src/content/changelog/sandbox/2026-10-22-emudhra-certificates.mdx b/src/content/changelog/sandbox/2026-10-22-emudhra-certificates.mdx index d6e8d698d10..c1a5719f769 100644 --- a/src/content/changelog/sandbox/2026-10-22-emudhra-certificates.mdx +++ b/src/content/changelog/sandbox/2026-10-22-emudhra-certificates.mdx @@ -1,29 +1,24 @@ --- -title: Sandbox SDK 0.12.13 updates trusted certificates after the eMudhra compromise -description: Sandbox SDK images up to 0.12.12 trust certificates from the compromised eMudhra intermediate CAs. If you use Sandbox SDK 0.x, update your package and image to 0.12.13 immediately. +title: Sandbox SDK 0.12.14 updates trusted certificates after the eMudhra compromise +description: Sandbox SDK images before 0.12.14 trust certificates from the compromised eMudhra intermediate CAs. If you use Sandbox SDK 0.x, update your package and image to 0.12.14 immediately. products: - sandbox date: 2026-10-22 --- -The private keys of [eight eMudhra intermediate certificate authorities](https://blog.cloudflare.com/emudhra-certificate-compromise/) can be recovered, so anyone can forge a certificate for any hostname that chains to them. Sandbox SDK images up to 0.12.12 trust these certificates. An HTTPS connection that leaves the container directly, such as one from `mountBucket()`, backups, `gitCheckout()`, tunnels, or code that runs in the sandbox, can be intercepted with a forged certificate. +The private keys of [eight eMudhra intermediate certificate authorities](https://blog.cloudflare.com/emudhra-certificate-compromise/) can be recovered, so anyone can forge a certificate for any hostname that chains to them. Sandbox SDK images before 0.12.14 trust these certificates. An HTTPS connection that leaves the container directly, such as one from `mountBucket()`, backups, `gitCheckout()`, tunnels, or code that runs in the sandbox, can be intercepted with a forged certificate. ## What you need to do ### Sandbox SDK 0.x -Update immediately. Install `@cloudflare/sandbox@0.12.13`, change the `FROM` line in your `Dockerfile` to the matching image, and redeploy. Keep any `-python`, `-opencode`, or `-musl` suffix on the image tag. The deployment's [rollout](/containers/configuration/rollouts/) replaces running sandboxes with ones that use the new image. +Update immediately. Install `@cloudflare/sandbox@0.12.14`, change the `FROM` line in your `Dockerfile` to the matching image, and redeploy. Keep any `-python`, `-opencode`, or `-musl` suffix on the image tag. The deployment's [rollout](/containers/configuration/rollouts/) replaces running sandboxes with ones that use the new image. ```dockerfile title="Dockerfile" -FROM docker.io/cloudflare/sandbox:0.12.13 +FROM docker.io/cloudflare/sandbox:0.12.14 ``` -If your sandboxes run `bun` or OpenCode, or `createBackup()` uploads archives of 10 MiB or more, also apply these workarounds until a later release updates Bun. All three check certificates against Bun's built-in CA list rather than the image's. - -- For backups, pass `multipart: false` to [`createBackup()`](/sandbox/sdk/api/backups/#createbackup) to upload with `curl`, which uses the image's CA bundle. -- For `bun` and OpenCode, set [`interceptHttps = true`](/sandbox/sdk/guides/outbound-traffic/#https-traffic) and add an `outbound` handler that returns `fetch(request)`, so that Cloudflare checks their certificates. - -If your sandboxes use none of these, updating to 0.12.13 is all you need to do. +If you use the `next` prerelease, update to `0.13.0-next.825.1` or later. ### Sandbox SDK 1.x @@ -42,6 +37,8 @@ From inside a sandbox, connect to one of the test hosts listed at [emudhra.we-ha curl -f https://dv-g3b-emudhra.we-have-a-problem.com/ ``` -## What changed in 0.12.13 +## What changed in 0.12.13 and 0.12.14 In the 0.12.13 images, the system CA bundle, Node.js, `cloudflared`, and pip reject certificates from the compromised intermediates. The images ship updated Ubuntu and Alpine CA certificates, Node.js 22.23.4, `cloudflared` 2026.10.2, and pip 26.2.2 in the `-python` image. + +0.12.14 updates Bun to 1.4.4, so the `bun` command and `createBackup()` uploads of archives of 10 MiB or more reject these certificates too. The `-opencode` image ships OpenCode 1.19.4 or later, which also runs on Bun 1.4.4. From fdc8919d91e432880d6c07163be0de0097ddf922 Mon Sep 17 00:00:00 2001 From: Naresh Date: Thu, 22 Oct 2026 17:47:35 +0100 Subject: [PATCH 5/6] [Sandbox] Add the catch-all workaround Users on 0.8.7 or later who cannot update yet can send all HTTPS through their Worker, so that Cloudflare checks the certificates on port 443. The entry also says what that leaves uncovered: TLS on other ports, such as cloudflared tunnels. --- .../sandbox/2026-10-22-emudhra-certificates.mdx | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/content/changelog/sandbox/2026-10-22-emudhra-certificates.mdx b/src/content/changelog/sandbox/2026-10-22-emudhra-certificates.mdx index c1a5719f769..a159ed330aa 100644 --- a/src/content/changelog/sandbox/2026-10-22-emudhra-certificates.mdx +++ b/src/content/changelog/sandbox/2026-10-22-emudhra-certificates.mdx @@ -20,6 +20,18 @@ FROM docker.io/cloudflare/sandbox:0.12.14 If you use the `next` prerelease, update to `0.13.0-next.825.1` or later. +If you cannot update yet and use 0.8.7 or later, send all HTTPS through your Worker, so that Cloudflare checks every certificate on port 443 whatever your image trusts: + +```ts title="src/index.ts" +export class MySandbox extends Sandbox { + interceptHttps = true; +} + +MySandbox.outbound = (request: Request) => fetch(request); +``` + +Deploy, then stop running sandboxes so that they restart with the interception certificate. This does not cover TLS on other ports, such as `cloudflared` tunnels, and clients that ignore the injected certificate fail to connect. For more information, refer to [HTTPS traffic](/sandbox/sdk/guides/outbound-traffic/#https-traffic). + ### Sandbox SDK 1.x You do not need to update the SDK, because it makes no TLS connections of its own. Your image decides which certificates your sandboxes trust, so rebuild it and replace the sandboxes that run the old one: From 5680030b36354f9399db7089c320ffd44500ae4f Mon Sep 17 00:00:00 2001 From: Naresh Date: Fri, 23 Oct 2026 11:38:53 +0100 Subject: [PATCH 6/6] [Sandbox] Export ContainerProxy in the workaround Outbound interception needs the ContainerProxy export from the Worker entrypoint. Without it, @cloudflare/containers throws before the container starts, so a reader who copied the snippet as written would stop their sandboxes from starting instead of protecting them. --- .../changelog/sandbox/2026-10-22-emudhra-certificates.mdx | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/content/changelog/sandbox/2026-10-22-emudhra-certificates.mdx b/src/content/changelog/sandbox/2026-10-22-emudhra-certificates.mdx index a159ed330aa..fedaaa18867 100644 --- a/src/content/changelog/sandbox/2026-10-22-emudhra-certificates.mdx +++ b/src/content/changelog/sandbox/2026-10-22-emudhra-certificates.mdx @@ -23,6 +23,9 @@ If you use the `next` prerelease, update to `0.13.0-next.825.1` or later. If you cannot update yet and use 0.8.7 or later, send all HTTPS through your Worker, so that Cloudflare checks every certificate on port 443 whatever your image trusts: ```ts title="src/index.ts" +import { Sandbox, ContainerProxy } from "@cloudflare/sandbox"; +export { ContainerProxy }; + export class MySandbox extends Sandbox { interceptHttps = true; }