{"id":"CVE-2026-115570","kind":"vulnerability","aliases":["CVE-2026-115570","GHSA-jr5w-w6x2-84p9"],"related":[],"title":"Electron: Mitigation for compromised eMudhra intermediate certificates","description":"### Impact\n\nA set of eMudhra intermediate certificates were compromised and are being blocked by browsers and other TLS clients. This Electron update adds the same block to both Chromium networking and Node.js `tls`, `https` and `fetch`. On earlier versions, an attacker holding a certificate issued through these intermediates and able to intercept network traffic could impersonate a TLS server to an app.\n\nApps are only affected if they make TLS connections over a network an attacker can intercept. Apps that make no network connections are not affected.\n\nOther software has shipped the same mitigation, including Go (CVE-2026-111943) and Firefox (CVE-2026-113470).\n\n### Workarounds\n\nThere are no app side workarounds, you must update to a patched version of Electron.\n\n### Fixed Versions\n\n* `45.0.0-beta.6`\n* `44.9.1`\n* `43.8.1`\n* `42.11.16`\n\n### For more information\n\nIf you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)","summary":"Electron shipped a blocklist for eMudhra intermediate certificates that were compromised, so Chromium networking and Node.js tls, https and fetch now reject them. Before the fix, an attacker holding a certificate issued through those intermediates and able to intercept traffic could impersonate a TLS server to an app.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"electron","fixed":["45.0.0-beta.6"],"affected":">= 45.0.0-alpha.1, < 45.0.0-beta.6","ecosystem":"npm"},{"name":"electron","fixed":["44.9.1"],"affected":">= 44.0.0-alpha.1, < 44.9.1","ecosystem":"npm"},{"name":"electron","fixed":["43.8.1"],"affected":">= 43.0.0-alpha.1, < 43.8.1","ecosystem":"npm"},{"name":"electron","fixed":["42.11.16"],"affected":"< 42.11.16","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-299","desktop-apps","electron","node","runtime"],"not_affected_if":["already-patched-version","no-network-connections"],"how_to_check":"Check the Electron version in the app's package.json or installed node_modules/electron/package.json.\nAn app is in range if its version is below 45.0.0-beta.6 on the 45 line, below 44.9.1 on 44, below 43.8.1 on 43, or below 42.11.16 on 42.\nApps that make no network connections are not affected.","fix":"Upgrade electron to 45.0.0-beta.6, 44.9.1, 43.8.1 or 42.11.16, matching your release line.\nThere are no app-side workarounds.","status":"open","published_at":"2026-10-23T19:17:44+00:00","first_seen_at":"2026-10-23T20:59:05+00:00","triaged_at":"2026-10-23T21:00:18+00:00","updated_at":"2026-10-23T21:57:34+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-23T21:00:18Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade electron to 45.0.0-beta.6, 44.9.1, 43.8.1 or 42.11.16, matching your release line.\nThere are no app-side workarounds.","reach":"network","impact":"high","summary":"Electron shipped a blocklist for eMudhra intermediate certificates that were compromised, so Chromium networking and Node.js tls, https and fetch now reject them. Before the fix, an attacker holding a certificate issued through those intermediates and able to intercept traffic could impersonate a TLS server to an app.","category":"runtime","who_cares":["electron","desktop-apps","node"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker impersonates a TLS server to the app using a compromised intermediate certificate.","analyst_note":"","how_to_check":"Check the Electron version in the app's package.json or installed node_modules/electron/package.json.\nAn app is in range if its version is below 45.0.0-beta.6 on the 45 line, below 44.9.1 on 44, below 43.8.1 on 43, or below 42.11.16 on 42.\nApps that make no network connections are not affected.","needs_analyst":false,"not_affected_if":["no-network-connections","already-patched-version"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000554,"input_tokens":3199,"output_tokens":468,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111943':177C '-113470':182C '-115570':10A,18A '-2026':9A,17A,176C,181C '-299':24B '42.11.16':205C '43.8.1':204C '44.9.1':203C '45.0.0':201C '84p9':15A 'abl':67B,128C 'add':101C 'advisori':218C 'affect':144C,165C 'app':27B,78B,140C,141C,157C,187C 'attack':58B,119C,154C 'beta.6':202C 'block':91C,104C 'blocklist':34B 'browser':93C 'certif':7A,38B,61B,85C,122C 'chromium':43B,107C 'client':97C 'comment':215C 'compromis':4A,41B,87C 'connect':149C,162C 'could':71B,133C 'cve':8A,16A,175C,180C 'cwe':23B 'desktop':26B 'desktop-app':25B 'earlier':116C 'electron':1A,19A,20A,21A,22A,28B,31B,99C,198C 'email':219C 'emudhra':5A,36B,83C 'fetch':50B,114C 'firefox':179C 'fix':56B,199C 'ghsa':12A 'ghsa-jr5w-w6x2-84p9':11A 'go':174C 'hold':59B,120C 'https':48B,112C 'impact':79C 'imperson':72B,134C 'includ':173C 'inform':208C 'intercept':69B,130C,156C 'intermedi':6A,37B,65B,84C,126C 'issu':62B,123C 'jr5w':13A 'mailto':223C 'make':147C,159C 'mitig':2A,172C 'must':191C 'network':44B,108C,131C,152C,161C 'node':29B 'node.js':46B,110C 'patch':195C 'question':213C 'reject':52B 'runtim':30B 'security@electronjs.org':222C,224C 'server':75B,137C 'set':81C 'ship':32B,169C 'side':188C 'softwar':167C 'tls':47B,74B,96C,111C,136C,148C 'traffic':70B,132C 'updat':100C,192C 'us':220C 'version':117C,196C,200C 'w6x2':14A 'workaround':183C,189C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T19:17:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-jr5w-w6x2-84p9","url":"https://github.com/advisories/GHSA-jr5w-w6x2-84p9","severity":"high","published_at":"2026-10-23T20:53:41+00:00","modified_at":"2026-10-23T20:53:43+00:00","first_seen_at":"2026-10-23T20:59:05+00:00","fetched_at":"2026-10-23T20:59:05+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-115570","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115570","severity":null,"published_at":"2026-10-23T19:17:44+00:00","modified_at":"2026-10-23T21:17:22+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}