Security Advisory

CVE-2026-42355

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-05-12 19:20:35

Last updated 2026-05-13 15:37:46

Assigner GitHub_M

CVSS score 3.3

State PUBLISHED

Description

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the Electron Archive (ASAR) parser in NanaZip. When opening a crafted .asar file with deeply nested JSON in the header, both nlohmann::json::parse and the handler's GetAllPaths function recurse without depth limits, exhausting the thread stack and crashing the NanaZip process. This vulnerability is fixed in 6.0.1698.0.

← Browse all CVEs View on cve.org ↗