CVE-2026-34211: SandboxJS stack overflow via deeply nested expressions

CVE-2026-34211 · Severity: high · CVSS 7.5 · Published 2026-04-06

SandboxJS is a JavaScript sandbox library designed to safely execute untrusted code. The parser contains unbounded recursion that can be triggered by deeply nested expressions (e.g., thousands of nested parentheses), causing the Node.js process to crash with a stack overflow error. An attacker can crash any application using this library with a trivial, unauthenticated input.

Technologies: @nyariv/sandboxjs (npm), Nyariv Sandboxjs. Vendors: npm, Nyariv.

Quick answers

Is CVE-2026-34211 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34211 being exploited in the wild.
How severe is CVE-2026-34211?
High severity, with a CVSS score of 7.5, published 6 April 2026.
Which products and versions are affected?
@nyariv/sandboxjs (npm) SEMVER:introduced=0,fixed=0.8.36; Nyariv Sandboxjs <= 0.8.35.
Is there a fix for CVE-2026-34211?
Yes. @nyariv/sandboxjs (npm): upgrade to 0.8.36 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34211 attacked?
It is attacked over the network.
Am I affected by CVE-2026-34211?
Check whether you run @nyariv/sandboxjs (npm) or Nyariv Sandboxjs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @nyariv/sandboxjs (npm): upgrade to 0.8.36 or later
    npm install @nyariv/sandboxjs@0.8.36

Technical details

The vulnerability is an uncontrolled recursion flaw (CWE-674) in the recursive descent parser. Two code paths are vulnerable: (1) the restOfExp function in src/parser.ts lacks depth tracking and recursively calls itself for each nested bracket without limit; (2) the lispify→lispifyExpr call chain similarly processes nested groups with no recursion depth check. The parser accepts user input directly from all public API methods (Sandbox.parse(), Sandbox.compile(), compileExpression(), etc.) with no depth validation. An attacker supplies deeply nested expressions (approximately 2000+ levels) to trigger RangeError: Maximum call stack size exceeded. In Node.js, this exception is not catchable in the normal sense and crashes the entire process, making this a denial-of-service vector. The fix requires adding a depth parameter to both recursive chains with a maximum depth check (suggested: 256) that throws a ParseError when exceeded. Patched in version 0.8.36.

Affected products

  • nyariv SandboxJS <= 0.8.35

Identifiers

  • CVE-2026-34211
  • GHSA-8pfc-jjgw-6g26

Timeline

  • 2026-04-03: disclosed
  • 2026-04-03: patched: Version 0.8.36 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.