Beveiligingsadvies

CVE-2026-42355

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-05-12 19:20:35

Laatst bijgewerkt 2026-05-13 15:37:46

Toegewezen door GitHub_M

CVSS-score 3.3

Status PUBLISHED

Beschrijving

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the Electron Archive (ASAR) parser in NanaZip. When opening a crafted .asar file with deeply nested JSON in the header, both nlohmann::json::parse and the handler's GetAllPaths function recurse without depth limits, exhausting the thread stack and crashing the NanaZip process. This vulnerability is fixed in 6.0.1698.0.

← Alle CVE's bekijken Bekijk op cve.org ↗