CVE-2026-42355 M2Team CVE debrief

Who should care

End-users who rely on NanaZip for archive management, particularly those handling Electron application packages or archives from external sources. System administrators managing software deployment tools that may process .asar files. Security teams monitoring for denial-of-service vectors in file parsing applications.

Technical summary

The vulnerability exists in NanaZip's Electron Archive (ASAR) format handler. The ASAR format uses JSON headers to describe file layout within the archive. The parser utilizes nlohmann::json::parse for header deserialization and implements a custom GetAllPaths function to enumerate archive contents. Neither implementation enforces recursion depth limits. A malicious actor can craft an .asar file with deeply nested JSON structures—such as excessively nested objects or arrays—in the header section. When NanaZip attempts to open this file, the recursive descent in both the JSON parser and GetAllPaths causes rapid stack consumption. On Windows systems with default thread stack sizes (typically 1MB), this results in stack overflow exception (0xC00000FD) and process termination. The attack requires local access and user interaction (opening the malicious archive), limiting practical exploitability but enabling denial-of-service attacks against users who handle archives from untrusted sources.

Defensive priority

LOW

Recommended defensive actions

• Upgrade NanaZip to version 6.0.1698.0 or later to eliminate the vulnerability
• Implement application controls to block or quarantine .asar files from untrusted sources until patching is complete
• Monitor for unexpected NanaZip process crashes as potential indicators of exploitation attempts
• Review and update endpoint protection policies to detect anomalous archive parsing behavior

Evidence notes

The vulnerability affects NanaZip from version 5.0.1250.0 (per CPE criteria) or 5.0.1252.0 (per CVE description) through versions before 6.0.1698.0. The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L confirms local attack vector requiring user interaction, with low availability impact. CWE-674 (Uncontrolled Recursion) is the primary weakness classification.

Official resources