Vulnerability Identifier: NR26-12
Priority: High
Summary
Between October 17 and October 20, 2026, researchers disclosed that the private keys from eight intermediate certificate authority (CA) certificates issued by eMudhra could be recovered. Anyone with those keys could create certificates that software would accept as genuine if it still trusts them. Although major operating systems and web browsers have already revoked trust for these certificates, applications managing independent CA trust stores, including some container images, need to be updated.
New Relic has rebuilt the container images it provides for Synthetics Private locations so they no longer use these certificates. Customers who run Synthetics Private locations need to pull the new images and restart their containers, because the images are not automatically updated.
Action items
Public locations
Customer action depends on whether your monitors are on the latest runtime.
Scenario | Action required |
|---|---|
| No action required: New Relic has already deployed patched images. |
Scripted API monitors on Node.js 16.10 | Action required: Migrate to Node.js 22.23.0. For details, see Important notice: Node.js 16.x migration required. |
To identify monitors still running on the legacy runtime, run the following NRQL query in your account's query builder:
SELECT uniques(monitorName) FROM SyntheticCheck WHERE runtimeType = 'NODE_API' AND runtimeTypeVersion = '16.10' SINCE 1 day agoYou can also identify affected monitors in the Synthetics EOL screen in the New Relic UI. Filter by Monitor Type: Script API to view all monitors still running on Node.js 16.10.
Private locations
Action required: All customers running Private locations must manually pull the latest images and redeploy, regardless of runtime version.
Pull the latest versions of all Synthetics Private location images, including the Synthetics job manager (SJM) and all runtimes:
Image
Version
newrelic/synthetics-job-managerv642 or newer
newrelic/synthetics-node-api-runtime1.2.296 or newer
newrelic/synthetics-node-browser-runtime3.0.259 or newer
newrelic/synthetics-ping-runtime1.87.0 or newer
Restart your containers.
For more information, see the runtime transition guide.
Important notice: Node.js 16.x migration required (Public and Private locations)
Scripted API monitors running on Node.js 16.10 will reach end-of-life on November 18, 2026. These monitors are exposed to the eMudhra vulnerability, and monitors still running on these older versions must be migrated to Node.js 22.23.0. This applies whether your monitors run on Public or Private locations.
Recommended action: Starting November 18, 2026, New Relic will automatically upgrade Public location monitors still running on Node.js 16.x to the current runtime. We strongly recommend that you migrate as soon as possible, before that date, so you can test that your monitors continue to operate as intended on the new runtime and move off the vulnerable version. For instructions, see Upgrade scripted API monitors to Node.js 22.
Technical vulnerability information
No CVEs have been assigned for this issue.
Frequently asked questions
Was New Relic's Public location infrastructure affected?
New Relic has patched Public location infrastructure running on the latest runtime. However, monitors explicitly pinned to Node.js 16.x will continue to run on that version until updated by the account owner.
Were any monitor results tampered with?
New Relic has no evidence of tampering with our synthetic images.
Do I need to rotate credentials stored in Synthetics secure credentials?
No action is required unless you have a specific reason to believe your network and infrastructure were compromised.
Who can I contact if I still have questions?
Open a case with our Support team through the help section in the New Relic platform.
Publication history
October 17-20, 2026 - eMudhra intermediate CA certificate compromise disclosed
November 6, 2026 - NR26-12 Published