GHSA-jr5w-w6x2-84p9 CVE-2026-115570
Electron: Mitigation for compromised eMudhra intermediate certificates
- Severity
- 7.4 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.38%
- Chance of exploitation in the next 30 days. Higher than 31.72% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-299 Improper Check for Certificate Revocation
- Fix
45.0.0-beta.6- Upgrade electron to this version or later
Description
Impact
A set of eMudhra intermediate certificates were compromised and are being blocked by browsers and other TLS clients. This Electron update adds the same block to both Chromium networking and Node.js tls, https and fetch. On earlier versions, an attacker holding a certificate issued through these intermediates and able to intercept network traffic could impersonate a TLS server to an app.
Apps are only affected if they make TLS connections over a network an attacker can intercept. Apps that make no network connections are not affected.
Other software has shipped the same mitigation, including Go (CVE-2026-111943) and Firefox (CVE-2026-113470).
Workarounds
There are no app side workarounds, you must update to a patched version of Electron.
Fixed Versions
45.0.0-beta.644.9.143.8.142.11.16
For more information
If you have any questions or comments about this advisory, email us at security@electronjs.org
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| electron | >= 45.0.0-alpha.1, < 45.0.0-beta.6 |
45.0.0-beta.6 |
| electron | >= 44.0.0-alpha.1, < 44.9.1 |
44.9.1 |
| electron | >= 43.0.0-alpha.1, < 43.8.1 |
43.8.1 |
| electron | < 42.11.16 |
42.11.16 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
electron npm → 45.0.0-beta.6
- npm
npm install electron@45.0.0-beta.6- yarn
yarn add electron@45.0.0-beta.6- pnpm
pnpm add electron@45.0.0-beta.6
Severity breakdown
CVSS 3.1 7.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Weakness
CWE-299: Improper Check for Certificate Revocation
The product does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a certificate that has been compromised.
How to prevent it
- Architecture and Design: Ensure that certificates are checked for revoked status.
- Implementation: If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the revoked status.
References
Packages
Other links
- github.com/electron/electron/security/advisories/GHSA-jr5w-w6x2-84p9
- github.com/electron/electron/pull/55127
- github.com/electron/electron/pull/55128
- github.com/electron/electron/pull/55129
- github.com/electron/electron/pull/55130
- github.com/electron/electron/commit/093583c71be71c85453e6e225137bf2af755fbcc
- github.com/electron/electron/commit/1d2f13b1985444a38abf389db38228ac42f5bcad
- github.com/electron/electron/commit/817c43f925677eb88034bfba4f0b8dfd28e7ad20
- github.com/electron/electron/commit/e02265be96c5e13ae43644ef482b718e1e800499
- github.com/electron/electron/releases/tag/v42.11.16
- github.com/electron/electron/releases/tag/v43.8.1
- github.com/electron/electron/releases/tag/v44.9.1
- github.com/electron/electron/releases/tag/v45.0.0-beta.6
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-qqvq-6xgj-jw8g Electron affected by libvpx's heap buffer overflow in vp8 encoding | High Known exploited | Also affects electron |
| GHSA-j7hp-h8jx-5ppr libwebp: OOB write in BuildHuffmanTable | High Known exploited | Also affects electron |
| GHSA-995f-9x5r-2rcj Heap buffer overflow in GPU | Critical Known exploited | Also affects electron |
| GHSA-h3v5-h239-pg29 Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry | Low | Also affects electron |
| GHSA-3qxv-5xgr-q7w9 Electron: Frame subscription trusts GPU-supplied frame geometry | Low | Also affects electron |
| GHSA-997q-gvvc-jwmx Electron: openExternal permission requests can be attributed to the wrong origin | Medium | Also affects electron |
| GHSA-fw47-9c62-h3vw Electron: HID and USB permission checks can be attributed to the wrong origin | Medium | Also affects electron |
| GHSA-x562-297c-g43g Electron: Pointer lock permission requests can be attributed to the wrong frame | Medium | Also affects electron |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor