GitHub Advisoryadvisory · npm
GHSA-q6m5-f73j-m9mc Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow
CRITICAL
Official page ↗
- Aliases
- CVE-2026-54257
- Ecosystem
- npm
- Packages
- electron
- Severity
- Critical
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Weaknesses
- CWE-120
- Reviewed
- 2026-06-15
Affected packages
• npm electron: >= 42.3.1, < 42.3.3 → fixed in 42.3.3
Description
Impact
Most apps will crash and some may perform incorrect buffer allocations in the Node.js `Buffer` API resulting in unexpected truncation or allocation.
Workarounds
No workarounds. Do not use these impacted Electron releases
Fixed Versions
• `42.3.3`
For more information
If you have any questions or comments about this advisory, email us at [email protected]
Related
Alias · CVE (1)
- CVE-2026-54257 Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. vulnerability
Weakness · CWE (1)
- CWE-120 Buffer Copy without Checking Size of Input weakness