CompatHub
Check EOL

Package compatibility

Electron 33

What Node.js versions does this Electron version support?

Compatibility is derived from the declared Node.js version requirement (npm engines.node). CompatHub does not independently test every combination.

Declared Node.js requirement

engines.node
>= 12.20.55
Tip version
33.4.11
Source
npm Registry (engines.node)

Node.js compatibility matrix

Evaluated against CompatHub Node.js VersionLines. Compatibility and lifecycle status are separate signals.

Other Electron lines

Security

Advisories affecting Electron 33 (OSV.dev evidence). Known exploited status, due dates, and ransomware use from CISA KEV when matched.

Known vulnerabilities
15
Known exploited
0
Highest CVSS
—
  • CVE-2026-70612GHSA-p2rr-rvmm-c5fp

    Electron: Sandboxed iframes can launch external protocol handlers

    Affected:
    <39.8.8
    Fixed in:
    39.8.8
    Source:
    OSV source
  • CVE-2026-70611GHSA-f2r8-jv7c-xqmp

    Electron: DevTools embedder handler executes arbitrary files via shell open

    Affected:
    <39.8.9
    Fixed in:
    39.8.9
    Source:
    OSV source
  • CVE-2026-70610GHSA-ff2p-hmqr-hxm4

    Electron: contextBridge object copy honors prototype setters

    Affected:
    <39.8.9
    Fixed in:
    39.8.9
    Source:
    OSV source
  • CVE-2026-70609GHSA-4f78-qhmw-8j8m

    Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter

    Affected:
    <39.8.7
    Fixed in:
    39.8.7
    Source:
    OSV source
  • CVE-2026-70608GHSA-9f4c-93c8-jc8g

    Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

    Affected:
    <39.8.10
    Fixed in:
    39.8.10
    Source:
    OSV source
  • CVE-2026-70607GHSA-v93f-fgjr-hjrj

    Electron: window.open features string controls some window options considered privileged

    Affected:
    <39.8.8
    Fixed in:
    39.8.8
    Source:
    OSV source
  • CVE-2026-70605GHSA-v64r-4m7r-3mvq

    Electron: HTTP redirect followed into local file loader

    Affected:
    <39.8.8
    Fixed in:
    39.8.8
    Source:
    OSV source
  • CVE-2026-70604GHSA-v3j7-r9gq-3gjw

    Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

    Affected:
    <39.8.10
    Fixed in:
    39.8.10
    Source:
    OSV source
  • CVE-2026-70602GHSA-m55f-7gqj-fr98

    Electron: Extension tab APIs operate across session boundaries

    Affected:
    <39.8.8
    Fixed in:
    39.8.8
    Source:
    OSV source
  • CVE-2026-70603GHSA-5c9j-mhmv-5xgx

    Electron: shell.openPath path validation bypass via embedded null byte

    Affected:
    <39.8.6
    Fixed in:
    39.8.6
    Source:
    OSV source
  • CVE-2026-70601GHSA-h7rp-cf8h-j98x

    Electron: Context isolation bypass via Function.prototype.bind hijack

    Affected:
    <39.8.9
    Fixed in:
    39.8.9
    Source:
    OSV source
  • CVE-2026-70600GHSA-x8rc-wpg4-grpf

    Electron: Cross-origin iframe can position native autofill popup

    Affected:
    <39.8.8
    Fixed in:
    39.8.8
    Source:
    OSV source
  • CVE-2026-70599GHSA-9pf5-hg6p-4pwp

    Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin

    Affected:
    <39.8.7
    Fixed in:
    39.8.7
    Source:
    OSV source
  • CVE-2026-70598GHSA-pfmc-3mgc-p6fp

    Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size

    Affected:
    <39.8.10
    Fixed in:
    39.8.10
    Source:
    OSV source
  • CVE-2026-70597GHSA-jm7p-cc5g-qwxx

    Electron: Parent process code-sign check is spoofable

    Affected:
    <39.8.8
    Fixed in:
    39.8.8
    Source:
    OSV source