CVE-2026-115570 Electron: Mitigation for compromised eMudhra intermediate certificates
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-115570?
CVE-2026-115570 is a high-severity vulnerability in electron, published on 23 Oct 2026.
Official description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6, Electron does not block compromised eMudhra intermediate certificates in Chromium networking, Node.js tls, Node.js https, or Node.js fetch. An attacker who holds a certificate issued through one of these intermediates and can intercept network traffic can impersonate a TLS server to an affected application. This issue is fixed in versions 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6.
Weakness: CWE-299
Which versions are affected by CVE-2026-115570?
8 open source packages ship an affected version, including electron.
| Package | Affected | Fixed in |
|---|---|---|
electron npm | All versions | 42.11.16 |
electron npm | All versions | 42.11.16 |
electron npm | From 43.0.0-alpha.1 | 43.8.1 |
electron npm | From 43.0.0-alpha.1 | 43.8.1 |
electron npm | From 44.0.0-alpha.1 | 44.9.1 |
electron npm | From 44.0.0-alpha.1 | 44.9.1 |
2 more packages
electron npm | From 45.0.0-alpha.1 | 45.0.0-beta.6 |
electron npm | From 45.0.0-alpha.1 | 45.0.0-beta.6 |
How do I fix CVE-2026-115570?
Upgrade electron to a fixed version for your release line: 42.11.16, 43.8.1, 44.9.1 or 45.0.0-beta.6.
Is CVE-2026-115570 being exploited?
There is no known exploitation of CVE-2026-115570 in the wild and no public exploit code.
Sources
Also known as GHSA-jr5w-w6x2-84p9.