GHSA-jr5w-w6x2-84p9 Electron: Mitigation for compromised eMudhra intermediate certificates

• npm electron: >= 45.0.0-alpha.1, < 45.0.0-beta.6 → fixed in 45.0.0-beta.6 • npm electron: >= 44.0.0-alpha.1, < 44.9.1 → fixed in 44.9.1 • npm electron: >= 43.0.0-alpha.1, < 43.8.1 → fixed in 43.8.1 • npm electron: < 42.11.16 → fixed in 42.11.16

Impact A set of eMudhra intermediate certificates were compromised and are being blocked by browsers and other TLS clients. This Electron update adds the same block to both Chromium networking and Node.js `tls`, `https` and `fetch`. On earlier versions, an attacker holding a certificate issued through these intermediates and able to intercept network traffic could impersonate a TLS server to an app. Apps are only affected if they make TLS connections over a network an attacker can intercept. Apps that make no network connections are not affected. Other software has shipped the same mitigation, including Go (CVE-2026-111943) and Firefox (CVE-2026-113470). Workarounds There are no app side workarounds, you must update to a patched version of Electron. Fixed Versions • `45.0.0-beta.6` • `44.9.1` • `43.8.1` • `42.11.16` For more information If you have any questions or comments about this advisory, email us at [email protected]