CVE-2026-34775 is a medium severity flaw in Electron. NVD scores it 6.8. In some process sharing setups, workers in frames set to nodeIntegrationInWorker false could still get Node.js integration. Only apps that enable the option are affected. Upgrade to 38.8.6, 39.8.4, 40.8.4 or 41.0.0.
What's affected
Electron before 38.8.6, 39.8.4, 40.8.4 and 41.0.0. Fixed versions are 38.8.6 on the 38 line, 39.8.4 on 39, 40.8.4 on 40 and 41.0.0.
Apps are only affected if they enable nodeIntegrationInWorker. Apps that do not use it are not affected, per the advisory.
How to check if you're exposed
List the Electron version your app ships:
npm ls electron
Then search your code for the webPreferences setting:
grep -rn "nodeIntegrationInWorker" src
If the option is never enabled, you are not in scope. If it is, look at whether the app opens child windows or embeds content with different webPreferences.
What to do now
- Upgrade Electron to the fixed version for your major line and ship a new build.
- If you cannot upgrade yet, stop enabling nodeIntegrationInWorker in apps that also open child windows or embed content with differing webPreferences. That is the advisory's workaround.
- Rebuild and redistribute, because Electron is bundled with the app and a server side patch does not reach installed copies.
- Add Electron to your dependency inventory so you can see which apps ship which version.
Why it matters
The weakness is CWE-653, insufficient compartmentalization. A setting meant to apply to one frame leaked into another through process sharing, so a worker got Node.js powers that its frame did not ask for.
Node.js integration in a worker means web content could reach file system and process APIs, which is why the confidentiality and integrity impact is high. The rating stays medium because of the narrow conditions: the option must be on and the attacker must be able to run content in the affected setup.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Try it yourself
A dependency can be present and still not be reachable. This demo shows how to tell the difference.
Click through it at your own pace, or open it full screen.
Quick check
My app does not use workers. Do I need to act?
The advisory says apps that do not use nodeIntegrationInWorker are not affected. Still upgrade on your normal schedule, since the fixed versions carry other changes.
Can I fix this by updating the server?
No. Electron ships inside each desktop app, so you need a new app build.
Sources
Last reviewed: 19 October 2026.
