# CVE-2026-32723: SandboxJS execution-quota bypass in timers

Source: https://junglewise.ai/threats/cve-2026-32723-sandboxjs-execution-quota-bypass-in-timers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-16. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-32723 · Severity: medium · CVSS 4 · Published 2026-03-16

SandboxJS is a JavaScript sandbox library used to safely execute untrusted code in isolated environments with configurable resource limits. A race condition in timer handling allows attackers to bypass execution quotas by manipulating shared global state, enabling CPU-intensive loops to run unchecked and exhaust system resources affecting the host and other tenants.

Technologies: [@nyariv/sandboxjs (npm)](https://junglewise.ai/threats/technologies/nyariv-sandboxjs), [Nyariv Sandboxjs](https://junglewise.ai/threats/technologies/sandboxjs). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Nyariv](https://junglewise.ai/threats/vendors/nyariv).

## Quick answers

**Is CVE-2026-32723 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-32723 being exploited in the wild.

**How severe is CVE-2026-32723?** Medium severity, with a CVSS score of 4, published 16 March 2026.

**Which products and versions are affected?** @nyariv/sandboxjs (npm) SEMVER:introduced=0,fixed=0.8.35; Nyariv Sandboxjs <=0.8.34.

**Is there a fix for CVE-2026-32723?** Yes. @nyariv/sandboxjs (npm): upgrade to 0.8.35 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-32723 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-32723?** Check whether you run @nyariv/sandboxjs (npm) or Nyariv Sandboxjs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @nyariv/sandboxjs (npm): upgrade to 0.8.35 or later

  ```sh
  npm install @nyariv/sandboxjs@0.8.35
  ```


## Technical details

The vulnerability is a race condition (CWE-362) in SandboxJS's timer implementation where a global tick state (currentTicks.current) shared across all sandbox instances is read at timer execution time rather than scheduling time. Timer string handlers are compiled lazily when the timer fires, allowing another sandbox running concurrently to overwrite currentTicks.current between scheduling and execution. This causes the timer callback to execute under a different sandbox's tick budget, bypassing the original sandbox's execution quota watchdog. Attack requires multiple concurrent sandbox instances in the same process; no authentication or network access needed. A malicious script can trigger CPU exhaustion or resource starvation attacks. The vulnerability was fixed in version 0.8.35.

## Affected products

- nyariv SandboxJS <=0.8.34

## Identifiers

- CVE-2026-32723
- GHSA-7p5m-xrh7-769r

## Timeline

- 2026-03-16: disclosed
- 2026-03-16: patched: Fixed in version 0.8.35

## References

- [https://github.com/nyariv/SandboxJS/security/advisories/GHSA-7p5m-xrh7-769r](https://github.com/nyariv/SandboxJS/security/advisories/GHSA-7p5m-xrh7-769r)

## Related threats

- [nyariv SandboxJS sandbox escape via Function.caller leakage](https://junglewise.ai/threats/cve-2026-43898-nyariv-sandboxjs-sandbox-escape-via-function-caller-leakage)
- [SandboxJS sandbox escape via Prop object leak in new handler](https://junglewise.ai/threats/cve-2026-34217-sandboxjs-sandbox-escape-via-prop-object-leak-in-new-handler)
- [SandboxJS stack overflow via deeply nested expressions](https://junglewise.ai/threats/cve-2026-34211-sandboxjs-stack-overflow-via-deeply-nested-expressions)
- [SandboxJS sandbox integrity escape via constructor manipulation](https://junglewise.ai/threats/cve-2026-34208-nyariv-sandboxjs-sandbox-integrity-escape-via-constructor-bypass)
- [SandboxJS sandbox escape allowing remote code execution](https://junglewise.ai/threats/cve-2026-26954-sandboxjs-sandbox-escape-allowing-remote-code-execution)