CriticalGHSA-q6m5-f73j-m9mcCVE-2026-54257
Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow
Published 15 Jun 2026 · Updated 20 Jul 2026
Affected package
electronnpm
- Affected
- >=42.3.1 <42.3.3
- Fixed in
- 42.3.3
Update to the fixed version for your release line, for example:
npm install electron@42.3.3Details
Impact
Most apps will crash and some may perform incorrect buffer allocations in the Node.js Buffer API resulting in unexpected truncation or allocation.
Workarounds
No workarounds. Do not use these impacted Electron releases
Fixed Versions
42.3.3
For more information
If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)
Is GHSA-q6m5-f73j-m9mc in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected electron, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.