OpenClaw v2026.10.6 requires patched Node after the eMudhra CA key compromise

OpenClaw v2026.10.6 is a security patch rather than a feature release, and the thing to do before you run the update is to deal with Node: the release notes say OpenClaw "now requires Node 24.22.1 or newer on Node 24, or 26.12.1 or newer on Node 26, because older Node builds may still trust the affected certificates." The reason given on the page is that the release "adds remediations for the eMudhra certificate compromise", a certificate-authority key compromise that Google and Red Hat both published accounts of earlier in the week. If you run the Docker images or the installers you already have a patched Node, because the notes say those "already use the patched versions"; if you manage Node yourself, that upgrade is yours to do first.

One dating note, because the two primary records differ in what they carry. The release notes page in the OpenClaw documentation has no publication date of its own. The dated record is the release on the project's GitHub repository, which shows "released this 22 Oct 12:53" beside the v2026.10.6 tag.

#What is in OpenClaw v2026.10.6?

The notes describe the release in their own words as "a patch release with no new features. It contains urgent fixes for problems that could stop OpenClaw from installing, updating, or starting, plus smaller reliability fixes." The scale line puts it at "233 pull requests, 30 direct commits, and 149 contributors", so most of it is work you will never notice. The table below is the part that asks something of you, in each case quoting what the page says to do.

Two of the smaller fixes are worth a glance if they describe your installation: the release "fixes false "offline maintenance" and database errors that could stop a fresh Windows setup, Doctor, or the Gateway from starting", and Gateway shutdown "now waits for pending cleanup to finish", giving Windows more time to confirm it has stopped.

#Why does this release require a newer Node?

Because the problem sits below OpenClaw, in which certificates the Node process will accept. Google's Chrome Root Program published its account on 20 October 2026: it was notified on 17 October at 18:05 UTC that the private keys for eight eMudhra subordinate CA certificates were compromised, and says those keys "were generated with insufficient randomness". That is the part that makes it urgent rather than procedural, because anyone able to recover such a key could issue a certificate for any website that a client still trusting those CAs would accept. The same post refers later to "these six intermediate CAs" without explaining the difference in count, so treat the exact number as unsettled between those two sentences.

Red Hat's bulletin RHSB-2026-012, published on 21 October, names the roots involved: "The compromised eMudhra intermediates were signed by two root CAs: Comodo AAA Services root and emSign ECC Root CA - G3." It is also careful about scope in a way worth repeating, saying the compromise "does not by itself mean any system has been compromised" while an attacker "could issue fraudulent TLS certificates for any domain". Red Hat tracks the issue as CVE-2026-111943 in the Go ecosystem and its own ca-certificates fix as CVE-2026-114406.

Google also says Android devices received an equivalent update through Google Play Services, and that restarting a device triggers it immediately. For site operators the instruction is direct: if your certificate chains to emSign ECC Root CA - G3, obtain and install a new TLS certificate from another hierarchy in the Chrome Root Store, or those certificates will stop working in Chrome after the root is removed.

#Does Node's own release say the same thing?

Not in those words, which is worth knowing if you are judging how urgent this is for your own installation. Node 24.22.1 and 26.12.1 both shipped on 21 October 2026 and both open with "This is a security release". Both list "crypto: update root certificates to NSS 3.131.1" and "tls: reject chains containing blocked public keys" among their changes, which is the shape of a fix for this kind of incident. Neither of those two release pages names eMudhra, though, and neither says what the root-certificate update changes, so the connection between the Node upgrade and this compromise is OpenClaw's characterisation rather than something Node states on either page. The CVEs Node does tag on those two releases, CVE-2026-106069, CVE-2026-106072 and CVE-2026-105483, concern IP address handling in TLS rather than certificate authorities.

That gap does not change what you should do, because OpenClaw's requirement stands on its own: the floor is in the release notes, and an installation below it is one OpenClaw asks you to raise before starting it. It does mean you should not repeat "Node patched the eMudhra roots" as though Node had said so.

#What should you do before you upgrade?

Confirm which Node you are actually running with node --version, upgrade it if you manage it yourself, and only then update OpenClaw. The documented update command is openclaw update, and openclaw update status shows the channel, availability and the latest update report. If you want to see what an update would do without doing it, openclaw update --dry-run --json reports the installed version in currentVersion and the target in targetVersion.

openclaw update --dry-run --json
openclaw update status
openclaw update

If an update stops part way, OpenClaw troubleshooting covers the usual recovery paths, and the OpenClaw migration guide covers the general shape of a version move. For what OpenClaw is, what it runs on and which of its surfaces are exposed, start at our OpenClaw hub.

Everything above was checked on 23 October 2026 against the v2026.10.6 release notes, the project's GitHub release, Google's and Red Hat's own publications and the two Node release pages. OpenClaw ships every few days, so look at the project's releases page for the version that is current when you read this rather than assuming v2026.10.6 still is.