CVE-2026-34767: Electron: HTTP Response Header Injection in custom protocol handlers and webRequest
Impact Apps that register custom protocol handlers via protocol.handle() / protocol.registerSchemesAsPrivileged() or modify response headers via webRequest.onHeadersReceived may be vulnerable to HTTP response header injection if attacker-controlled input is reflected into a response header name or value.
An attacker who can influence a header value may be able to inject additional response headers, affecting cookies, content security policy, or cross-origin access controls.
Apps that do not reflect external input into response headers are not affected.
Workarounds Validate or sanitize any untrusted input before including it in a response header name or value.
Fixed Versions 41.0.3 40.8.3 39.8.3 38.8.6
For more information If there are any questions or comments about this advisory, send an email to security@electronjs.org
Other sources
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.3, 40.8.3, and 41.0.3, apps that register custom protocol handlers via protocol.handle() / protocol.registerSchemesAsPrivileged() or modify response headers via webRequest.onHeadersReceived may be vulnerable to HTTP response header injection if attacker-controlled input is reflected into a response header name or value. An attacker who can influence a header value may be able to inject additional response headers, affecting cookies, content security policy, or cross-origin access controls. Apps that do not reflect external input into response headers are not affected. This issue has been patched in versions 38.8.6, 39.8.3, 40.8.3, and 41.0.3.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 41.0.3 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 40.8.3 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 39.8.3 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 38.8.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 38.8.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 39.8.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 40.8.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 41.0.3 - Configuration
In Electron apps, validate or sanitize any untrusted input before including it in an HTTP response header name or value (especially when using protocol.handle() / protocol.registerSchemesAsPrivileged() or webRequest.onHeadersReceived).
Electron (custom protocol handlers / webRequest.onHeadersReceived) Validate or sanitize untrusted input before including it in a response header name or value = required