CVE-2026-42355

Executive Summary

CVE-2026-42355 is a denial-of-service (DoS) vulnerability in NanaZip, an open-source file archiver. The flaw resides in the Electron Archive (ASAR) parser, specifically in how it handles deeply nested JSON structures within the ASAR header. An attacker can craft a malicious .asar file containing a JSON header with extreme nesting depth. When NanaZip attempts to parse this file, both the nlohmann::json::parse function and the custom GetAllPaths handler recursively traverse the JSON tree without any depth limits. This uncontrolled recursion exhausts the thread stack, causing the NanaZip process to crash. The vulnerability affects versions from 5.0.1252.0 up to (but not including) 6.0.1698.0. The fix introduces recursion depth limits to prevent stack exhaustion.

Supply Chain & Package Security

NanaZip is distributed as a standalone application, not as an NPM, PyPI, Go, or Ruby package. Therefore, supply chain package security considerations are not directly applicable. However, users should ensure they download NanaZip only from the official GitHub repository or trusted distribution channels to avoid tampered binaries.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
• Base Score: 3.3 (Low)
• Attack Vector (AV): Local (L) – The attacker must provide a malicious file to the victim.
• Attack Complexity (AC): Low (L) – No special conditions are required to trigger the vulnerability.
• Privileges Required (PR): None (N) – The attacker does not need any privileges.
• User Interaction (UI): Required (R) – The victim must open the malicious file with NanaZip.
• Scope (S): Unchanged (U) – The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): None (N) – No data is modified.
• Availability (A): Low (L) – The crash causes a temporary denial of service for the NanaZip process.

Threat Level: Low. The vulnerability requires user interaction and only results in a crash, not code execution or data compromise. However, it can be used to disrupt operations if users are tricked into opening malicious archives.

Deep Dive & Mechanics

The vulnerability is rooted in the ASAR (Electron Archive) parser within NanaZip. ASAR files are used by Electron applications to package resources. The file format includes a JSON header that describes the archive's contents. This header can contain nested objects representing directory structures.

When NanaZip opens an ASAR file, it performs the following steps:

1. Reads the file header to locate the JSON content.
2. Calls nlohmann::json::parse to parse the JSON string into a tree structure.
3. Invokes a custom handler function GetAllPaths to recursively traverse the parsed JSON tree and extract file paths.

Both nlohmann::json::parse and GetAllPaths are recursive functions. In a normal ASAR file, the nesting depth is shallow (typically less than 100 levels). However, an attacker can craft a JSON header with thousands of nested objects, e.g., {"a":{"a":{"a":...}}}. When the parser attempts to parse this, each nested level consumes stack space. Once the stack is exhausted, the program crashes with a stack overflow exception.

The vulnerability is classified under CWE-674 (Uncontrolled Recursion). The fix in version 6.0.1698.0 introduces a maximum recursion depth limit (e.g., 512 levels) in both the JSON parser and the GetAllPaths function. If the depth exceeds this limit, parsing is aborted and an error is returned, preventing the crash.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

// In ASAR parser
void GetAllPaths(const nlohmann::json& node, std::vector<std::string>& paths) {
    for (auto& [key, value] : node.items()) {
        if (value.is_object()) {
            GetAllPaths(value, paths); // No depth check
        }
        paths.push_back(key);
    }
}

void ParseASAR(const std::string& json_str) {
    auto root = nlohmann::json::parse(json_str); // No depth limit
    std::vector<std::string> paths;
    GetAllPaths(root, paths);
}

Patched Code (simplified):

constexpr size_t MAX_DEPTH = 512;

void GetAllPaths(const nlohmann::json& node, std::vector<std::string>& paths, size_t depth = 0) {
    if (depth > MAX_DEPTH) {
        throw std::runtime_error("ASAR header nesting too deep");
    }
    for (auto& [key, value] : node.items()) {
        if (value.is_object()) {
            GetAllPaths(value, paths, depth + 1);
        }
        paths.push_back(key);
    }
}

void ParseASAR(const std::string& json_str) {
    auto root = nlohmann::json::parse(json_str, nullptr, true, MAX_DEPTH); // Use nlohmann's depth limit
    std::vector<std::string> paths;
    GetAllPaths(root, paths, 0);
}

The patch adds a MAX_DEPTH constant and passes it to both the JSON parser and the recursive handler. This ensures that if the nesting exceeds the limit, an exception is thrown instead of a stack overflow.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Objective: Crash NanaZip by tricking a user into opening a malicious ASAR file.

Steps:

1. Generate a deeply nested JSON structure. For example, using Python:

   import json
   depth = 10000
   nested = {}
   current = nested
   for i in range(depth):
       current["a"] = {}
       current = current["a"]
   with open("malicious.asar", "w") as f:
       json.dump(nested, f)
   

2. The resulting malicious.asar file contains a JSON header with 10,000 levels of nesting.
3. Deliver the file to the victim via email, download link, or physical media.
4. When the victim opens the file with NanaZip (versions 5.0.1252.0 to 6.0.1697.9), the application crashes immediately.

Expected Outcome: NanaZip process terminates with a stack overflow error. No data is exfiltrated, but the application becomes unavailable.

Blue Team (Defense & Detection)

Detection:

• Monitor for crashes of the NanaZip process (nanazip.exe or similar) with exit code indicating stack overflow (e.g., STATUS_STACK_OVERFLOW).
• Use file scanning to detect ASAR files with abnormally deep JSON nesting (e.g., > 1000 levels).
• Deploy endpoint detection rules that flag processes consuming excessive stack memory.

Mitigation:

• Update NanaZip to version 6.0.1698.0 or later.
• If immediate patching is not possible, consider blocking ASAR files from untrusted sources or using a sandbox to open them.
• Educate users not to open .asar files from unknown senders.

Indicators of Compromise (IOCs)

• File Hashes (example):
  • SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (placeholder – actual malicious file hash will vary)
• File Names:
  • malicious.asar
  • payload.asar
  • Any .asar file from untrusted sources
• Process Behavior:
  • NanaZip process (nanazip.exe) crashes with stack overflow exception.
  • Event ID 1000 (Application Error) in Windows Event Log with faulting module nanazip.exe and exception code 0xC00000FD (stack overflow).
• Network Indicators:
  • None – the vulnerability is triggered locally without network activity.

Detection Engineering

YARA Rule

rule CVE_2026_42355_NanaZip_ASAR_DeepNesting {
    meta:
        description = "Detects ASAR files with deeply nested JSON headers indicative of CVE-2026-42355"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-42355"
        hash = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
    strings:
        $json_start = "{"
        $json_end = "}"
        $asar_magic = { 41 53 41 52 } // "ASAR" magic bytes
    condition:
        $asar_magic at 0 and
        #json_start > 1000 and
        #json_end > 1000
}

Sigma Rule

title: NanaZip Crash Due to Deeply Nested ASAR Header
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects NanaZip process crashes caused by stack overflow from malicious ASAR files (CVE-2026-42355)
author: Valters IT
date: 2026-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-42355
logsource:
    product: windows
    service: application
detection:
    selection:
        EventID: 1000
        ApplicationName: 'nanazip.exe'
        ExceptionCode: '0xc00000fd'
    condition: selection
falsepositives:
    - Legitimate ASAR files with unusual nesting (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-42355 - Malicious ASAR File Download"; flow:to_client; fileext:"asar"; content:"|41 53 41 52|"; depth:4; pcre:"/\{.*\{.*\{.*\{/R"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Update NanaZip to version 6.0.1698.0 or later. The fix is available on the official GitHub repository: https://github.com/M2Team/NanaZip/releases.
2. Workaround: If patching is not possible, avoid opening .asar files from untrusted sources. Use a different archive tool for ASAR files until the update is applied.

Long-Term Measures:

• Implement input validation for all file parsers to enforce depth limits.
• Conduct code reviews focusing on recursive functions to ensure they have proper termination conditions.
• Use static analysis tools to detect potential stack overflow vulnerabilities.
• Monitor for similar CVEs in other archive parsers (e.g., 7-Zip, WinRAR) that may have analogous issues.

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. All information is provided for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal.