CompaniesContentstackIncidents
Contentstack: Contentstack - Azure EU - Webhook Signature Validation Issue
Timeline of updates
- resolved
A standard security upgrade to Node.js 24 with OpenSSL 3 was deployed as part of our security hardening efforts. The upgrade introduced stricter RSA-PSS signature validation per RFC 8017 standards, changing the default salt length from a previously lenient range (32-222) to strictly enforcing 32 for SHA-256. This impacted webhook functionality for configurations using RSA-based certificates with salt lengths greater than 32. Upon identifying the impact, the update was promptly reverted to restore normal operations.
Archive proof
Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert.
How the archive is checked, and what it cannot prove.
This incident predates live tracking (October 17, 2026). It came from the vendor’s own published history, which is not covered by checkpoints.
Impact, status and times are the vendor’s own, as last archived. View on stspg.io (opens in new tab).
Contentstack profileRecent Contentstack incidentsMarkdownJSON