CVE-2026-42355: NanaZip: Uncontrolled recursion in NanaZip Electron ASAR parser causes stack exhaustion
NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the Electron Archive (ASAR) parser in NanaZip. When opening a crafted .asar file with deeply nested JSON in the header, both nlohmann::json::parse and the handler's GetAllPaths function recurse without depth limits, exhausting the thread stack and crashing the NanaZip process. This vulnerability is fixed in 6.0.1698.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42355?
CVE-2026-42355 is classified as a high severity vulnerability due to the potential for stack exhaustion.
How do I fix CVE-2026-42355?
To fix CVE-2026-42355, update NanaZip to version 6.0.1698.0 or later.
What causes CVE-2026-42355?
CVE-2026-42355 is caused by uncontrolled recursion in the Electron Archive (ASAR) parser within NanaZip.
Which versions of NanaZip are affected by CVE-2026-42355?
NanaZip versions from 5.0.1252.0 to before 6.0.1698.0 are affected by CVE-2026-42355.
What happens if CVE-2026-42355 is exploited?
Exploitation of CVE-2026-42355 can lead to a stack exhaustion, potentially causing the application to crash.