I will just leave it here: https://emudhra.we-have-a-problem.com/ and https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE/m/0XofdebrAAAJ?pli=1
ca-certificates should be upgraded urgently.
It is also backported to OpenWrt 24.10:
Does someone know if Tailscale is vulnerable on OpenWrt? Tailscale states that their builds v1.104.2 onwards are patched with those certs revoked / blacklisted. In OpenWrt's repo the package's Makefile has +ca-bundle, so I was thinking if it uses updated (system's) certificates during build only.
I know the discussion around the upgrade topic, but I've upgraded ca-certificates with apk for now. 
Yes, it should be one of the packages it's safe to upgrade.
The issue is that if you upgrade for instance the Kernel but not each and every Kernel module then stuff breaks hard.
A bunch of Kernel unrelated files are safe sure. But it's hard to teach and tell every novice user the fine grain details so it has settled to just tell the story of do not upgrade packages because you need to know what you are up to. That's all. Have fun and stay safe and online