PT-2026-29997 · Npm · Electron

Published 2026-04-03 · Updated 2026-04-03 · CVE-2026-34767

OSV

CVSS v3.1

5.9

Medium

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N

Impact

Apps that register custom protocol handlers via protocol.handle() / protocol.registerSchemesAsPrivileged() or modify response headers via webRequest.onHeadersReceived may be vulnerable to HTTP response header injection if attacker-controlled input is reflected into a response header name or value.

An attacker who can influence a header value may be able to inject additional response headers, affecting cookies, content security policy, or cross-origin access controls.

Apps that do not reflect external input into response headers are not affected.

Workarounds

Validate or sanitize any untrusted input before including it in a response header name or value.

Fixed Versions

• 41.0.3
• 40.8.3
• 39.8.3
• 38.8.6

For more information

If there are any questions or comments about this advisory, send an email to [e-mail]

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

CWE-113

Related Identifiers

CVE-2026-34767

GHSA-4P4R-M79C-WQ3V

Affected Products

Electron

References · 3

• https://osv.dev/vulnerability/GHSA-4p4r-m79c-wq3v · Vendor Advisory
• https://github.com/electron/electron · Note
• https://github.com/electron/electron/security/advisories/GHSA-4p4r-m79c-wq3v · Note