https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-44215.htmlhttps://patchthecve.com/cve/CVE-2026-44215.htmlMon, 26 Oct 2026 18:10:00 +0000MEDIUM 4.4: NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a one-byte heap out-of-bounds null write exists in the UFS/UFS2 filesystem image parser in NanaZip. The vulnerability is triggered when opening a crafted UFS filesystem image. The attacker controls the byte offset of the whttps://patchthecve.com/cve/CVE-2026-42446.htmlhttps://patchthecve.com/cve/CVE-2026-42446.htmlMon, 26 Oct 2026 18:10:00 +0000MEDIUM 4.4: NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a stack-based out-of-bounds read exists in the ZealFS filesystem image parser in NanaZip. The vulnerability is triggered when opening a crafted ZealFS v1 filesystem image. An attacker-controlled BitmapSize field in the filhttps://patchthecve.com/cve/CVE-2026-42445.htmlhttps://patchthecve.com/cve/CVE-2026-42445.htmlMon, 26 Oct 2026 18:10:00 +0000LOW 3.3: NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the UFS/UFS2 filesystem image parser in NanaZip. The function GetAllPaths recurses into subdirectories without any depth limit or visited-inode tracking. A crafted UFS imaghttps://patchthecve.com/cve/CVE-2026-42444.htmlhttps://patchthecve.com/cve/CVE-2026-42444.htmlMon, 26 Oct 2026 18:10:00 +0000LOW 3.3: NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a denial-of-service vulnerability exists in the littlefs filesystem image parser in NanaZip. The handler's Open method reads BlockCount directly from the attacker-controlled superblock without any validation against the achttps://patchthecve.com/cve/CVE-2026-42443.htmlhttps://patchthecve.com/cve/CVE-2026-42443.htmlMon, 26 Oct 2026 18:10:00 +0000LOW 3.3: NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an integer divide-by-zero exists in the UFS/UFS2 filesystem image parser in NanaZip. The vulnerability is triggered when opening a crafted UFS image where the superblock field fs_ipg (inodes per cylinder group) is set to zhttps://patchthecve.com/cve/CVE-2026-42442.htmlhttps://patchthecve.com/cve/CVE-2026-42442.htmlMon, 26 Oct 2026 18:10:00 +0000LOW 3.3: NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a null-pointer dereference exists in the UFS/UFS2 filesystem image parser in NanaZip. The vulnerability is triggered when opening a crafted UFS image where the root inode (inode 2) is set to IFLNK (symlink) instead of IFDIhttps://patchthecve.com/cve/CVE-2026-42355.htmlhttps://patchthecve.com/cve/CVE-2026-42355.htmlMon, 26 Oct 2026 18:10:00 +0000LOW 3.3: NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the Electron Archive (ASAR) parser in NanaZip. When opening a crafted .asar file with deeply nested JSON in the header, both nlohmann::json::parse and the handler's GetAllP