GHSA-jr5w-w6x2-84p9: High severity npm/electron vulnerability
Impact
A set of eMudhra intermediate certificates were compromised and are being blocked by browsers and other TLS clients. This Electron update adds the same block to both Chromium networking and Node.js tls, https and fetch. On earlier versions, an attacker holding a certificate issued through these intermediates and able to intercept network traffic could impersonate a TLS server to an app.
Apps are only affected if they make TLS connections over a network an attacker can intercept. Apps that make no network connections are not affected.
Other software has shipped the same mitigation, including Go (CVE-2026-111943) and Firefox (CVE-2026-113470).
Workarounds
There are no app side workarounds, you must update to a patched version of Electron.
Fixed Versions
45.0.0-beta.6 44.9.1 43.8.1 42.11.16
For more information
If you have any questions or comments about this advisory, email us at security@electronjs.org
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 42.11.16 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 43.8.1 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 44.9.1 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 45.0.0-beta.6 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 42.11.16 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 43.8.1 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 44.9.1 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 45.0.0-beta.6
Event History
Frequently Asked Questions
Which Electron applications are exposed to this issue?
An application is exposed only if it makes TLS connections over a network that an attacker can intercept. Applications that make no network connections are not affected.
What does an attacker need to exploit this vulnerability?
The attacker must possess a certificate issued through one of the compromised eMudhra intermediate certificates and be able to intercept the application's network traffic. They could then impersonate a TLS server to the application.
Are both Chromium-based requests and Node.js TLS requests covered by the fix?
Yes. The Electron update blocks the compromised intermediates in Chromium networking and in Node.js tls, https, and fetch.
What can be done if upgrading Electron is not immediately possible?
There are no application-side workarounds. Updating Electron to a patched release is required; fixed versions are 45.0.0-beta.6, 44.9.1, 43.8.1, and 42.11.16.