CVE-2026-42355 — NanaZip: Uncontrolled recursion in NanaZip Electron ASAR parser causes stack exhaustion

CVE-2026-42355

NanaZip: Uncontrolled recursion in NanaZip Electron ASAR parser causes stack exhaustion PUBLISHED

Description (CNA)

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the Electron Archive (ASAR) parser in NanaZip. When opening a crafted .asar file with deeply nested JSON in the header, both nlohmann::json::parse and the handler's GetAllPaths function recurse without depth limits, exhausting the thread stack and crashing the NanaZip process. This vulnerability is fixed in 6.0.1698.0.

Affected (CNA)

Vendor / product	Versions
M2Team / NanaZip	affected >= 5.0.1250.0, < 6.0.1698.0

CWE

CWE-674

References

https://github.com/M2Team/NanaZip/security/advisories/GHSA-4gxf-p4q6-gfrf

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.