CVE-2026-27014

NanaZip is an open source file archive Starting in version 5.0.1252.0 and prior to version 6.0.1630.0, circular `NextOffset` chains cause an infinite loop, and deeply nested directories cause unbounded recursion (stack overflow) in the ROMFS archive parser. Version 6.0.1630.0 patches the issue.

Score

CVSS 3.1 5.5 Medium

Status

Analyzed - security-advisories@github.com

Published

2026-02-19

Last modified

2026-02-20

Weaknesses

CWE-674

Affected products

• Nanazip (M2team)

References

• https://github.com/M2Team/NanaZip/security/advisories/GHSA-fc89-3f57-h9q5