# CVE-2026-115570: Electron certificate blocklist bypass in Node.js TLS

Source: https://junglewise.ai/threats/cve-2026-115570-electron-is-a-framework-for-writing-cross-platform-desktop  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-115570 · Severity: high · CVSS 7.4 · Published 2026-10-23

Electron is a framework for building cross-platform desktop applications using web technologies. The framework failed to block compromised eMudhra intermediate certificates in Node.js networking components, allowing an attacker with a malicious certificate and network access to impersonate legitimate TLS servers and intercept encrypted communications to affected applications.

Technologies: [Electron](https://junglewise.ai/threats/technologies/electron-electron), [electron (npm)](https://junglewise.ai/threats/technologies/electron). Vendors: [Electron](https://junglewise.ai/threats/vendors/electron), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-115570 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115570 being exploited in the wild.

**How severe is CVE-2026-115570?** High severity, with a CVSS score of 7.4, published 23 October 2026.

**Which products and versions are affected?** Electron Before 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6; electron (npm) >= 45.0.0-alpha.1, < 45.0.0-beta.6, SEMVER:introduced=45.0.0-alpha.1,fixed=45.0.0-beta.6.

**Is there a fix for CVE-2026-115570?** Yes. electron (npm): upgrade to 45.0.0-beta.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115570 attacked?** It is attacked over the network or from the adjacent network, in a software library.

**Am I affected by CVE-2026-115570?** Check whether you run Electron or electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- electron (npm): upgrade to 45.0.0-beta.6 or later

  ```sh
  npm install electron@45.0.0-beta.6
  ```


## Technical details

Electron's Chromium engine maintained a compiled-in SPKI (SubjectPublicKeyInfo) blocklist of revoked certificates, but Node.js tls, https, and fetch modules lacked equivalent filtering, allowing a compromised certificate chain to fail in the renderer but succeed in Node.js components. An attacker with a certificate issued through a blocked intermediate and capability to intercept network traffic can perform man-in-the-middle attacks. The fix wraps X509_verify_cert to check Node.js contexts against a synchronized blocklist and report CERT_REVOKED for blocked chains.

## Affected products

- Electron Electron Before 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6

## Identifiers

- CVE-2026-115570
- GHSA-jr5w-w6x2-84p9

## Timeline

- 2026-10-23: disclosed
- 2026-10-19: patched

## References

- [https://github.com/electron/electron/commit/093583c71be71c85453e6e225137bf2af755fbcc](https://github.com/electron/electron/commit/093583c71be71c85453e6e225137bf2af755fbcc)
- [https://github.com/electron/electron/commit/1d2f13b1985444a38abf389db38228ac42f5bcad](https://github.com/electron/electron/commit/1d2f13b1985444a38abf389db38228ac42f5bcad)

## Related threats

- [Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry](https://junglewise.ai/threats/cve-2026-114124-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron: Frame subscription trusts GPU-supplied frame geometry](https://junglewise.ai/threats/cve-2026-114122-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron external protocol permission misattribution](https://junglewise.ai/threats/cve-2026-114121-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron HID/USB permission checks origin spoofing in iframes](https://junglewise.ai/threats/cve-2026-113800-electron-hid-and-usb-permission-checks-can-be-attributed-to-the)
- [Electron pointer lock permission bypass in cross-origin iframes](https://junglewise.ai/threats/cve-2026-113798-electron-is-a-framework-for-writing-cross-platform-desktop)