CVE-2026-34211: @nyariv/sandboxjs Stack Overflow DoS via Deeply Nested Expressions
Summary
CVE-2026-34211: SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parser. Affects @nyariv/sandboxjs versions < 0.8.36. Fixed in 0.8.36. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @nyariv/sandboxjs package is a JavaScript sandbox designed to safely execute untrusted code. It allows developers to parse and compile JavaScript expressions in a controlled environment, making it suitable for applications that require executing user-generated scripts. However, the package is vulnerable to a denial-of-service (DoS) attack due to unbounded recursion in its parsing logic, which can be exploited by deeply nested expressions.
Vulnerability Detail
The vulnerability arises from unbounded recursion in the restOfExp function and the lispify/lispifyExpr call chain within the parser. An attacker can exploit this by providing deeply nested expressions (e.g., ~2000 nested parentheses), leading to a RangeError: Maximum call stack size exceeded. This error crashes the Node.js process, resulting in a denial of service. The vulnerability affects all public API methods of the package, which do not validate user input or impose depth limits, making it easy for attackers to disrupt services.
How To Fix
Latest published version: 0.9.7 as of 23 Oct 2026
npm install @nyariv/sandboxjs@0.9.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.8.36
This is the first release that contains the fix.
npm install @nyariv/sandboxjs@0.8.36Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the package immediately, consider implementing input validation to limit the depth of nested expressions before passing them to the sandbox. For example, you can check the depth of parentheses or brackets in the input string and reject any input that exceeds a safe limit.
Conclusion
The @nyariv/sandboxjs package is vulnerable to a denial-of-service attack due to unbounded recursion in its parsing logic. It is crucial for developers using this package to update to the patched version 0.8.36 or later to mitigate the risk of service disruption. Implementing input validation can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for @nyariv/sandboxjs →
FAQ
The CVSS score of this vulnerability is 6.9, indicating a moderate severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application without requiring access to the code by using the package-lock.json file.
The primary impact is denial of service, where an attacker can crash the Node.js process, leading to service disruption for applications using the sandbox to execute untrusted code.
Yes, you can implement input validation to limit the depth of nested expressions and reject any input that exceeds a predefined limit.
You can find more details in the official advisory on GitHub or by visiting the Vulert website for real-time monitoring of vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for @nyariv/sandboxjs.
