RomM 5.4.1: A ROM Library That Distrusts a Compromised CA

By Indie Kings | October 30, 2026

Updated October 30, 2026: RomM, the self-hosted ROM manager and player, shipped version 5.4.1 on October 22, 2026 with mitigations for the eMudhra intermediate CA compromise. The repository reports 14,165 stars, 790 forks and 172 contributors, is AGPL-3.0 licensed, and was created on March 8, 2023.

Image: a Nintendo Game Boy cartridge, the kind of file a self-hosted ROM manager catalogues, via Wikimedia Commons.

A ROM library is a server

RomM scans, enriches, browses and plays a ROM collection from a self-hosted web application. It supports more than 400 platforms and pulls metadata from IGDB, Screenscraper, LaunchBox and MobyGames, with artwork from SteamGridDB and achievement tracking through RetroAchievements. It handles multi-disk games, DLC, mods, hacks and manuals, and it can apply romhacks and translations on the fly with a built-in ROM patcher. Saves and states sync across devices with conflict resolution, and games can run in the browser through EmulatorJS and RuffleRS without a local emulator setup.

The feature list is unusually broad for a self-hosted project. There are per-user permissions and OIDC single sign-on, official apps for Playnite, Android handhelds through Argosy, and custom firmware through Grout. The project is AGPL-3.0, says it has no tracking and no paid features, and positions itself around total control of the data. For a certain kind of player, that is the whole pitch: a library server that runs on a home NAS, presents a clean web UI, and does not depend on a storefront.

The architecture is why the security update matters. RomM is not a desktop file manager. It is a server with a database, a web frontend, metadata providers, image hosts and outbound HTTPS requests. It ships its own runtime dependencies, including a Python certificate bundle. When a certificate authority is compromised, every application that validates TLS with that bundle has to decide whether to trust the old chain or update. A ROM manager may not look like critical infrastructure, but it holds account data, save files and a network service, and it makes outbound requests on the user's behalf.

The eMudhra problem in plain terms

On October 20, 2026, a public incident site reported that the private keys of eight eMudhra intermediate CA certificates had been compromised. The keys were incorrectly generated by the certificate authority, which meant anyone could recover them from the certificates themselves. The certificates were created in April 2025, and the compromised intermediates chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs, plus many downstream trust stores.

The consequence is straightforward. An attacker with the private key of a compromised intermediate can impersonate any website or service that chains to it. The root programs moved quickly: Firefox and Chrome blocked the certificates on October 17, Microsoft platforms on October 20 and Apple products on October 22. Browsers and operating systems can distribute revocation information through mechanisms such as OneCRL, CRLite and CRLSets. Many other clients cannot. Applications and libraries that ship their own CA bundle, including Electron apps, only pick up the fix when they are updated to a patched release.

That is the gap RomM addressed. A self-hosted server may use its own certificate bundle for outbound requests to metadata providers, image hosts or other services. If that bundle still trusts a compromised intermediate, the server could be tricked into accepting a certificate issued by an attacker. The RomM release does not claim that this happened. It says the update includes mitigations and recommends upgrading, and it adds that the maintainers do not believe RomM instances are vulnerable. The distinction matters: this is a precautionary update, not a breach disclosure.

The broader lesson is that certificate hygiene is part of running a server. Updating the operating system or the browser is not enough for an application that carries its own trust store. The eMudhra incident is a clean example because the compromise was demonstrated publicly and the remediation is a dependency bump. It is also a reminder that self-hosted software is only as current as its last update, and a ROM library that has not been touched since the summer is carrying a trust store from the summer.

What 5.4.1 actually changes

The release notes for 5.4.1 are dominated by dependency work. The key change is certifi 2026.10.19, which distrusted the compromised eMudhra intermediates. The release also bumps uv to 0.13.4, aiohttp to 3.14.4, Node to 24.22.1 for the October 2026 security release, Pillow to 13, Storybook to 10.6.2, Vite to 8.3.4, follow-redirects to 1.16.1 and handlebars to 4.7.10. There are documentation changes, a CI update and a handful of routine dependency bumps that do not affect behavior.

That is not a glamorous changelog, and it is not supposed to be. A server project that ships a security patch should make the security change easy to see and the rest of the diff boring. The release notes put the eMudhra mitigation at the top, recommend upgrading as soon as possible, and state the project's assessment of exposure. That is the right order. The alternative, burying a certificate change among feature notes, is how users miss it.

The version number also tells a story. RomM 5.4.1 is a patch on 5.4.0, which shipped on October 10, and 5.4.0-beta.1 before that on October 9. The project is releasing often, which is good for security but demanding for anyone who self-hosts. A user who pinned 5.4.0 two weeks ago is already behind on a trust store change. The 213 open issues and pull requests against 172 contributors suggest a healthy but busy project, and the AGPL license means forks are allowed but the maintenance burden travels with them.

The practical advice is simple. If RomM is exposed to the network, update to 5.4.1, restart the service and confirm the version in the UI. If it is behind a reverse proxy, update the proxy's trust store as well, because the proxy may be the component making the TLS connection. If the instance is only reachable on a home LAN and makes no outbound requests, the exposure is lower, but the update is still cheap. The release is a patch, not a migration, so there is little reason to wait.

Project card

FAQ

What is RomM?
A self-hosted ROM manager and player that scans, enriches, browses and plays a ROM collection, with browser playback and save sync.

What is version 5.4.1?
A security and dependency update released on October 22, 2026, built around a certificate authority mitigation.

What is the eMudhra issue?
The private keys of eight eMudhra intermediate CA certificates were compromised, allowing an attacker to impersonate sites that chain to them.

Was RomM exploited?
The maintainers say they do not believe RomM instances are vulnerable. They still recommend upgrading as a precaution.

What changed in the update?
certifi 2026.10.19 distrusts the compromised intermediates, and several runtime and frontend dependencies were upgraded.

Is RomM free?
Yes. It is AGPL-3.0 with no paid features. Hosting costs and third-party metadata provider keys are separate.

Bottom Line

RomM 5.4.1 is a boring patch with an important reason behind it. The eMudhra intermediate CA compromise is exactly the kind of event that a self-hosted application cannot ignore, because the fix lives in a certificate bundle that ships with the app rather than in the browser. RomM's maintainers put the mitigation first, said plainly that they do not believe instances are vulnerable, and shipped the dependency updates alongside it. That is the correct response. If you run RomM, update it, restart it and update the reverse proxy too. If you do not, the release is still a useful reminder that the trust store is part of the software supply chain.

Sources

• GitHub rommapp/romm release 5.4.1, eMudhra mitigation, dependency upgrades and exposure statement, published October 22, 2026
• GitHub rommapp/romm README, features, platforms, metadata, playback, apps and license, accessed October 30, 2026
• eMudhra Intermediate CA Compromise incident site, timeline, cause and affected clients, published October 20, 2026 and updated October 28, 2026
• GitHub API metadata for rommapp/romm, stars, forks, contributors, issues, size and latest commit, accessed October 30, 2026

Related: Peach: A Local-First Media Manager With 13,000 Stars | Filee: A Drag and Drop Converter for 266 Formats With No Uploads