GHSA-jjp3-mq3x-295m — high GitHub Advisory (CVE-2026-34770) in npm/electron

Description

Impact

Apps that use the powerMonitor module may be vulnerable to a use-after-free. After the native PowerMonitor object is garbage-collected, the associated OS-level resources (a message window on Windows, a shutdown handler on macOS) retain dangling references. A subsequent session-change event (Windows) or system shutdown (macOS) dereferences freed memory, which may lead to a crash or memory corruption.

All apps that access powerMonitor events (suspend, resume, lock-screen, etc.) are potentially affected. The issue is not directly renderer-controllable.

Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions

41.0.0-beta.8
40.8.0
39.8.1
38.8.6

For more information

If there are any questions or comments about this advisory, please email [email protected]

Basic information

Type: reviewed
Severity: high
Advisory on GitHub: Open advisory ↗
Repository advisory: Open repository advisory ↗
Source code: Browse source ↗
Published (advisory): 2026-04-03 02:39:52 UTC
Updated: 2026-04-06 23:10:42 UTC
GitHub reviewed: 2026-04-03 02:39:52 UTC
NVD published: 2026-04-03

Score	Percentile
0.02%	3.96%

CVSS Scores

Base score	Version	Severity	Vector
7.0	3.1	—	`CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H` Click to expand Attack vector (AV:L) They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by. Attack complexity (AC:H) Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:R) A real person has to do something—click, install, enable—otherwise it doesn’t land. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:H) They could widely tamper with or forge data—trust in the data is badly hurt. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.

Identifiers

Type	Value
GHSA	GHSA-jjp3-mq3x-295m ↗
CVE	CVE-2026-34770 ↗

CWEs

CWE id	Name
CWE-416	Use After Free

Affected packages (4)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem	Package	Vulnerable range	First patched	Vulnerable functions
npm	electron	< 38.8.6	38.8.6	—
npm	electron	>= 39.0.0-alpha.1, < 39.8.1	39.8.1	—
npm	electron	>= 40.0.0-alpha.1, < 40.8.0	40.8.0	—
npm	electron	>= 41.0.0-alpha.1, < 41.0.0-beta.8	41.0.0-beta.8	—

Electron: Use-after-free in PowerMonitor on Windows and macOS