CVE-2026-42355 NanaZip: Uncontrolled recursion in NanaZip Electron ASAR parser causes stack exhaustion

What is CVE-2026-42355?

CVE-2026-42355 is a low-severity denial of service vulnerability in M2Team NanaZip, published on 12 May 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the Electron Archive (ASAR) parser in NanaZip. When opening a crafted .asar file with deeply nested JSON in the header, both nlohmann::json::parse and the handler's GetAllPaths function recurse without depth limits, exhausting the thread stack and crashing the NanaZip process. This vulnerability is fixed in 6.0.1698.0.

Weakness: CWE-674

Which versions are affected by CVE-2026-42355?

It affects 1 product.

Products include M2team Nanazip.

How do I fix CVE-2026-42355?

No fix has been published for CVE-2026-42355 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-42355 being exploited?

There is no known exploitation of CVE-2026-42355 in the wild and no public exploit code.

Other vulnerabilities in M2Team NanaZip

• CVE-2026-26282 NanaZip has DotNet Single file OOB Heap Read Medium 5.2
• CVE-2026-27709 NanaZip .NET Single-File Manifest Parser Vulnerable to Out-of-Bounds Read via Unchecked RelativePathLength Medium 5.1
• CVE-2026-27710 NanaZip .NET Single-File Parser Integer Underflow Leads to Unbounded Allocation (DoS) Medium 5.1
• CVE-2026-27711 NanaZip UFS Archive Parser Memory Corruption via Unvalidated Directory Record Length Medium 5.1
• CVE-2026-27014 NanZip has ROMFS Archive Infinite Loop / Stack Overflow Medium 5.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4gxf-p4q6-gfrf.