CVE-2026-42355 LOW

CVE-2026-42355: NanaZip: Uncontrolled recursion in NanaZip Electron ASAR parser causes stack exhaustion

Vendor M2Team
Product NanaZip
Weakness CWE-674
Published May 12, 2026
Last update May 13, 2026
View on NVD All CVEs

CVSS base score

3.3/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

What the vulnerability does

01Description

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the Electron Archive (ASAR) parser in NanaZip. When opening a crafted .asar file with deeply nested JSON in the header, both nlohmann::json::parse and the handler's GetAllPaths function recurse without depth limits, exhausting the thread stack and crashing the NanaZip process. This vulnerability is fixed in 6.0.1698.0.

Key dates

02Disclosure timeline

May 12, 2026 CVE published
May 13, 2026 Record updated