In short
- CVE-2026-54257 is a CRITICAL (CVSS 9.3) vulnerability affecting electron.
- Chance of exploitation in the next 30 days (EPSS): 0.43%, higher than 37.1% of all vulnerabilities.
- Fix: update to 42.3.3 or later.
| Package | Affected versions | Patched versions |
|---|
| electron npm | ≥ 42.3.1, < 42.3.3
| 42.3.3
|
Description
Impact
Most apps will crash and some may perform incorrect buffer allocations in the Node.js Buffer API resulting in unexpected truncation or allocation.
Workarounds
No workarounds. Do not use these impacted Electron releases
Fixed Versions
For more information
If you have any questions or comments about this advisory, email us at [email protected]
NVD description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.1 until 42.3.3, Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow. Most apps will crash and some may perform incorrect buffer allocations in the Node.js Buffer API resulting in unexpected truncation or allocation. This vulnerability is fixed in 42.3.3.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free