high7.5
CVE-2026-34211
SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parser
Impact
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, the @nyariv/sandboxjs parser contains unbounded recursion in the restOfExp function and the lispify/lispifyExpr call chain. An attacker can crash any Node.js process that parses untrusted input by supplying deeply nested expressions (e.g., ~2000 nested parentheses), causing a RangeError: Maximum call stack size exceeded that terminates the process. This vulnerability is fixed in 0.8.36.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @nyariv/sandboxjs | <= 0.8.35 | 0.8.36 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nyariv | Sandboxjs | before 0.8.36 |