[Kushalkhemka]

What and why

Adds oven-sh/bun#46300 (in Bun 1.4.4) to the engine patch series:

• A certificate chain that holds a public key on Node's blocked list fails verification with CERT_REVOKED.
• The bundled root certificates move to NSS 3.131.1: 118 roots, against 121 before.

Node shipped the same change in 22.23.4, 24.22.1 and 26.12.1.

How it was ported

It is one patch appended to patches/bun.patch. The other 26 patches are byte-for-byte unchanged.

The pinned engine is ten upstream TLS commits behind #46300, so the cherry-pick conflicted. The port keeps only:

• the blocked-key check (blocked_spkis.cpp, from upstream as is);
• the root certificate files, identical to upstream's;
• the two testing hooks.

It leaves out selectServerName and the self-issued leaf rule (upstream #44365), which came with those later commits.

The check runs everywhere the pinned engine verifies a chain:

• us_cert_verify_cb, set on every SSL context that usockets builds (node:tls, node:https, fetch, WebSocket);
• quic.c, which verifies chains itself for fetch over HTTP/3;
• node:quic's own SSL context.

How it was tested

• git am of the new series on the pinned commit gives the same tree as the port branch.
• The runtimes come from runtime run 41222431522.
• macOS runtime:
  • tls.rootCertificates.length is 118.
  • A server that sends an untrusted chain carrying the blocked eMudhra certificate (upstream's fixture): node:tls and fetch both fail with CERT_REVOKED.
  • Stock Bun 1.4.2 reports DEPTH_ZERO_SELF_SIGNED_CERT for the same server.
• Not tested: a trusted chain holding a blocked key. That needs bun:internal-for-testing, which release builds do not have, or a certificate issued under the blocked CA.

Checklist

• npm run check is clean and ./test.sh passes (patch file only)
• A test fails without this change (see above: manual check against the runtime)
• Speed or memory may change: before/after numbers from bench/ are above (to do before the release: one SHA-256 per certificate per handshake)
• Engine or build change: patches regenerated; runtimes built
• No CHANGELOG.md edits

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-31T17:53:50.752357Z	3de9b8f	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.