Packages / electron / Security

CriticalVulnerabilityGHSA-q6m5-f73j-m9mcCVE-2026-54257Published 15 Jun 2026

Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow

Affected releases · electron

  • 42.x42.3.1 – 42.3.2Fixed in 42.3.3

On 42.x, the newest line:

npm install electron@42.3.3
45.x

  1. Not affected

    45.0.0

    1 release, latest

42.x

  1. Not affected

    42.0.0 – 42.3.0

    5 releases

  2. Affected

    42.3.1 – 42.3.2

    2 releases

  3. Fixed

    42.3.3 – 42.11.18

    38 releases

1131 stable releases of electron, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for electron. It is read in your browser and sent nowhere.

What happens

Impact

Most apps will crash and some may perform incorrect buffer allocations in the Node.js Buffer API resulting in unexpected truncation or allocation.

Workarounds

No workarounds. Do not use these impacted Electron releases

Fixed Versions

  • 42.3.3

For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org