This is a recommended update. The main highlight is the Docker images' move to Eclipse Temurin JRE 25.0.5+8, which addresses the eMudhra CA compromise (CVE-2026-91403, CVE-2026-114820). A default Web3Signer setup is not affected by the compromise. Setups that use --tls-allow-ca-clients=true, remote key vaults (HashiCorp Vault, Azure Key Vault, AWS Secrets Manager, AWS KMS, GCP Secret Manager), a TLS eth1 downstream node or an https:// network URL may be. For more information, read our security notice.
Binary distributions (.tar.gz, .zip) use the host's Java and are not fixed by the JRE update. Update your Java runtime following the guidance in the security notice.
This release also upgrades Vert.x, Netty and Jackson to fix further CVEs, removes Pebble from the default Docker image, and adds nightly Trivy scanning of the published Docker images. See the sections below.
Security
- Docker images now ship Eclipse Temurin JRE 25.0.5+8, which no longer trusts the compromised eMudhra CA roots (adoptium/temurin#317); base image digests re-pinned. See the security notice. #1267
- Vert.x upgraded to 5.2.2 and Netty to 4.2.19.Final to fix CVE-2026-102479, CVE-2026-102467 and CVE-2026-102476. #1268
- Jackson 3 (
tools.jackson) upgraded to 3.1.7 to fix CVE-2026-91777. #1272 - The default (non-distroless) Docker image no longer ships Pebble, the unused service manager bundled with the Ubuntu base image, removing its Go stdlib CVE-2026-78667, CVE-2026-78669, CVE-2026-97031 and CVE-2026-111943. #1273
CI/Build Enhancements
- Trivy scans the published Docker images nightly, for both variants of the
developandlatesttags, and publishes HIGH/CRITICAL findings to GitHub code scanning under one category per image. Findings that have no upstream fix are reported too, and the run fails on findings like dependency-check. #1270
Downloads
Binaries
| Binary | Checksum |
|---|---|
| web3signer.tar.gz | Checksum |
| web3signer.zip | Checksum |
Docker
Default image (Ubuntu + Eclipse Temurin JRE 25):
docker pull consensys/web3signer:26.10.2
Hardened image (Google Distroless, read-only-filesystem compatible):
docker pull consensys/web3signer:26.10.2-distroless
Verify
Binaries, with the GitHub CLI:
# the file is the one published with this release
gh release verify-asset 26.10.2 web3signer-26.10.2.tar.gz --repo Consensys-Incorporated/web3signer
# the file was built by this repository's CI workflow
gh attestation verify web3signer-26.10.2.tar.gz --repo Consensys-Incorporated/web3signerDocker images: see Verifying image signatures and attestations.
Full Changelog: 26.10.1...26.10.2