Is CVE-2026-115570 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115570 being exploited in the wild.

How severe is CVE-2026-115570?

High severity, with a CVSS score of 7.4, published 23 October 2026.

Which products and versions are affected?

Electron Before 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6; electron (npm) >= 45.0.0-alpha.1, < 45.0.0-beta.6, SEMVER:introduced=45.0.0-alpha.1,fixed=45.0.0-beta.6.

Is there a fix for CVE-2026-115570?

Yes. electron (npm): upgrade to 45.0.0-beta.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-115570 attacked?

It is attacked over the network or from the adjacent network, in a software library.

Am I affected by CVE-2026-115570?

Check whether you run Electron or electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115570: Electron certificate blocklist bypass in Node.js TLS

Q: Is there a fix for CVE-2026-115570?

Yes. electron (npm): upgrade to 45.0.0-beta.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-115570 attacked?

It is attacked over the network or from the adjacent network, in a software library.

Q: Am I affected by CVE-2026-115570?

Check whether you run Electron or electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115570 · Severity: high · CVSS 7.4 · Published 2026-10-23

Electron is a framework for building cross-platform desktop applications using web technologies. The framework failed to block compromised eMudhra intermediate certificates in Node.js networking components, allowing an attacker with a malicious certificate and network access to impersonate legitimate TLS servers and intercept encrypted communications to affected applications.

Technologies: Electron, electron (npm). Vendors: Electron, npm.

Quick answers

Is CVE-2026-115570 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115570 being exploited in the wild.
How severe is CVE-2026-115570?: High severity, with a CVSS score of 7.4, published 23 October 2026.
Which products and versions are affected?: Electron Before 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6; electron (npm) >= 45.0.0-alpha.1, < 45.0.0-beta.6, SEMVER:introduced=45.0.0-alpha.1,fixed=45.0.0-beta.6.
Is there a fix for CVE-2026-115570?: Yes. electron (npm): upgrade to 45.0.0-beta.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115570 attacked?: It is attacked over the network or from the adjacent network, in a software library.
Am I affected by CVE-2026-115570?: Check whether you run Electron or electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

electron (npm): upgrade to 45.0.0-beta.6 or later
```
npm install electron@45.0.0-beta.6
```

Technical details

Electron's Chromium engine maintained a compiled-in SPKI (SubjectPublicKeyInfo) blocklist of revoked certificates, but Node.js tls, https, and fetch modules lacked equivalent filtering, allowing a compromised certificate chain to fail in the renderer but succeed in Node.js components. An attacker with a certificate issued through a blocked intermediate and capability to intercept network traffic can perform man-in-the-middle attacks. The fix wraps X509_verify_cert to check Node.js contexts against a synchronized blocklist and report CERT_REVOKED for blocked chains.

Affected products

Electron Electron Before 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6

Identifiers

CVE-2026-115570
GHSA-jr5w-w6x2-84p9

Timeline

2026-10-23: disclosed
2026-10-19: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.