CVE-2026-54257: Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow
Impact Most apps will crash and some may perform incorrect buffer allocations in the Node.js Buffer API resulting in unexpected truncation or allocation. Workarounds No workarounds. Do not use these impacted Electron releases Fixed Versions 42.3.3 For more information If you have any questions or comments about this advisory, email us at [email protected]
Published Jun 15, 2026 · Updated Jul 20, 2026
Affected packages
electron
- Ecosystem
- npm
- Affected
- >= 42.3.1, < 42.3.3
- Fixed in
- 42.3.3
- Check
npm ls electron
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Impact
Most apps will crash and some may perform incorrect buffer allocations in the Node.js Buffer API resulting in unexpected truncation or allocation.
Workarounds
No workarounds. Do not use these impacted Electron releases
Fixed Versions
42.3.3
For more information
If you have any questions or comments about this advisory, email us at [[email protected]](mailto:[email protected])
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology