CVE-2026-42355
NanaZip: Uncontrolled recursion in NanaZip Electron ASAR parser causes stack exhaustion
Vexday Risk Score
8Baixo
Decisão SSVC (CISA)
Track
Sem sinal de exploração → monitorar
CVSS 3.3EPSS 0.1%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
12 mai 2026Publicada no NVD
Recomendação: Monitorar — sem sinal de exploração no momento.
NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the Electron Archive (ASAR) parser in NanaZip. When opening a crafted .asar file with deeply nested JSON in the header, both nlohmann::json::parse and the handler's GetAllPaths function recurse without depth limits, exhausting the thread stack and crashing the NanaZip process. This vulnerability is fixed in 6.0.1698.0.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Produtos afetados
M2Team · NanaZipQuer saber se a sua infraestrutura está exposta a isto?
Falar com a TrueHacking →