CVE-2026-42355CWE-674

NanaZip: Uncontrolled recursion in NanaZip Electron ASAR parser causes stack exhaustion

Low · published May 12, 2026

CVSS v3.1
3.3
EPSS
0%
Percentile
3.7
In the wild
Unconfirmed
What it is

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the Electron Archive (ASAR) parser in NanaZip. When opening a crafted .asar file with deeply nested JSON in the header, both nlohmann::json::parse and the handler's GetAllPaths function recurse without depth limits, exhausting the thread stack and crashing the NanaZip process. This vulnerability is fixed in 6.0.1698.0.

The record
Technical detail
CVSS v3.1
3.3 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00148 · 3.7th percentile
Weakness
CWE-674 · Uncontrolled Recursion
Published
2026-05-12T19:20Z
EPSS history
Timeline
  • 12 MAY 19:20Z
    NanaZip: Uncontrolled recursion in NanaZip Electron ASAR parser causes stack exhaustion
    cvelistv5