CVE-2026-42355 — NanaZip: Uncontrolled recursion in NanaZip Electron ASAR parser causes stack exhaustion
NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the Electron Archive (ASAR) parser in NanaZip. Wh…
Published: 2026-05-12 · CVSS: 3.3 · CVSS 3.1
NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the Electron Archive (ASAR) parser in NanaZip. When opening a crafted .asar file with deeply nested JSON in the header, both nlohmann::json::parse and the handler's GetAllPaths function recurse without depth limits, exhausting the thread stack and crashing the NanaZip process. This vulnerability is fixed in 6.0.1698.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7