What is GHSA-q6m5-f73j-m9mc?

GHSA-q6m5-f73j-m9mc is a security advisory published by GitHub Security Advisories with Critical severity. Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow

Which CVE IDs does GHSA-q6m5-f73j-m9mc cover?

GHSA-q6m5-f73j-m9mc covers the following CVE IDs: CVE-2026-54257. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-q6m5-f73j-m9mc?

GHSA-q6m5-f73j-m9mc affects 1 product, including: npm/electron:\u003e= 42.3.1, \u003c 42.3.3.

GHSA-q6m5-f73j-m9mcCritical

Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow

Vendor

GitHub Security Advisories

Published

June 15, 2026

Last Modified

June 15, 2026

🔗 CVE IDs covered (1)

CVE-2026-54257 →

📋 Description

Impact

Most apps will crash and some may perform incorrect buffer allocations in the Node.js Buffer API resulting in unexpected truncation or allocation.

Workarounds

No workarounds. Do not use these impacted Electron releases

Fixed Versions

42.3.3

For more information

If you have any questions or comments about this advisory, email us at [email protected]

🎯 Affected products1

npm/electron:>= 42.3.1, < 42.3.3

🔗 References (2)

https://github.com/electron/electron/security/advisories/GHSA-q6m5-f73j-m9mc
https://github.com/advisories/GHSA-q6m5-f73j-m9mc