Executive brief
NanaZip is an open-source file archiver used to compress and extract various file formats. A vulnerability in how it handles Electron Archive (ASAR) files allows a specially crafted file to crash the application. If a user attempts to open a malicious archive, the program will stop responding or close unexpectedly, potentially causing a loss of unsaved work or disrupting operations.
Technical details
An uncontrolled recursion vulnerability (CWE-674) exists in the Electron Archive (ASAR) parser of NanaZip. The root cause is located in the ASAR handler's Open method, which passes a JSON header to the nlohmann::json::parse function and a subsequent GetAllPaths recursive function, neither of which enforce depth limits. An attacker can trigger this by providing a crafted .asar file containing approximately 2,000 levels of nested JSON. This leads to a stack overflow (STATUS_STACK_OVERFLOW) on Windows, resulting in a deterministic process crash. The vulnerability is triggered during the archive opening phase before significant user interaction occurs. It has been remediated in version 6.0.1698.0 by implementing depth limiting or converting the recursive logic to an explicit work queue.
Affected products
- M2Team NanaZip 5.0.1252.0 to 6.0.1698.0
Timeline
- 2026-04-27: advisory: GitHub Security Advisory published by M2Team
- 2026-05-12: disclosed: CVE-2026-42355 published to NVD