Electron: HTTP Response Header Injection in custom protocol handlers and webRequest
Published 3 Apr 2026 · Updated 6 Apr 2026
Affected packages
- Affected
- <38.8.6
- Fixed in
- 38.8.6
npm install electron@38.8.6- Affected
- >=39.0.0-alpha.1 <39.8.3
- Fixed in
- 39.8.3
npm install electron@39.8.3- Affected
- >=40.0.0-alpha.1 <40.8.3
- Fixed in
- 40.8.3
npm install electron@40.8.3- Affected
- >=41.0.0-alpha.1 <41.0.3
- Fixed in
- 41.0.3
npm install electron@41.0.3Details
Impact
Apps that register custom protocol handlers via protocol.handle() / protocol.registerSchemesAsPrivileged() or modify response headers via webRequest.onHeadersReceived may be vulnerable to HTTP response header injection if attacker-controlled input is reflected into a response header name or value.
An attacker who can influence a header value may be able to inject additional response headers, affecting cookies, content security policy, or cross-origin access controls.
Apps that do not reflect external input into response headers are not affected.
Workarounds
Validate or sanitize any untrusted input before including it in a response header name or value.
Fixed Versions
41.0.340.8.339.8.338.8.6
For more information
If there are any questions or comments about this advisory, send an email to [security@electronjs.org](mailto:security@electronjs.org)
Is GHSA-4p4r-m79c-wq3v in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected electron, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.