CVE-2026-42355: GHSL-2026-124_GHSL-2026-134: Memory corruption, information disclosure, and denial of service in NanaZip - CVE-2026-54616, CVE-2026-44215, CVE-2026-47222, CVE-2026-47223, CVE-2026-42446, CVE-2026-47224, CVE-2026-42442, CVE-2026-42443, CVE-2026-42445, CVE-2026-42355, CVE-2026-42444
NanaZip contains memory-safety, parsing, and resource-exhaustion vulnerabilities that can cause memory corruption, information disclosure, or denial of service.
Other sources
NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the Electron Archive (ASAR) parser in NanaZip. When opening a crafted .asar file with deeply nested JSON in the header, both nlohmann::json::parse and the handler's GetAllPaths function recurse without depth limits, exhausting the thread stack and crashing the NanaZip process. This vulnerability is fixed in 6.0.1698.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NanaZipto a version that resolves this vulnerability.Fixed in 6.0.1698.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42355?
CVE-2026-42355 is classified as a high severity vulnerability due to the potential for stack exhaustion.
How do I fix CVE-2026-42355?
To fix CVE-2026-42355, update NanaZip to version 6.0.1698.0 or later.
What causes CVE-2026-42355?
CVE-2026-42355 is caused by uncontrolled recursion in the Electron Archive (ASAR) parser within NanaZip.
Which versions of NanaZip are affected by CVE-2026-42355?
NanaZip versions from 5.0.1252.0 to before 6.0.1698.0 are affected by CVE-2026-42355.
What happens if CVE-2026-42355 is exploited?
Exploitation of CVE-2026-42355 can lead to a stack exhaustion, potentially causing the application to crash.