PT-2026-30273 · Sandboxjs+1 · Sandboxjs+1

Offset · Published 2026-04-03 · Updated 2026-04-06 · CVE-2026-34211

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions SandboxJS versions prior to 0.8.36

Description The @nyariv/sandboxjs parser contains unbounded recursion in the restOfExp function and the lispify/lispifyExpr call chain. An attacker can crash any Node.js process that parses untrusted input by supplying deeply nested expressions (e.g., ~2000 nested parentheses), causing a RangeError: Maximum call stack size exceeded that terminates the process. The root cause is in src/parser.ts, specifically in the restOfExp function (line 443) and the lispify and lispifyExpr functions. The vulnerability is triggered by the lack of a depth limit in the recursive calls. All public API methods (Sandbox.parse(), Sandbox.compile(), Sandbox.compileAsync(), Sandbox.compileExpression(), Sandbox.compileExpressionAsync()) are affected as they pass user input directly to parse() without input validation or depth limiting. A RangeError: Maximum call stack size exceeded in Node.js crashes the current execution context and can crash the entire process in synchronous server applications. The vulnerability allows for denial of service by crashing the host Node.js process with a single crafted input string.

Recommendations Add a depth parameter to restOfExp and throw a ParseError when a maximum depth is exceeded. Similarly, add depth tracking to lispify and lispifyExpr.

Fix

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2026-34211

GHSA-8PFC-JJGW-6G26

Affected Products

Node.Js

Sandboxjs

References · 4

• https://github.com/nyariv/SandboxJS/security/advisories/GHSA-8pfc-jjgw-6g26 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34211 · Security Note
• https://osv.dev/vulnerability/GHSA-8pfc-jjgw-6g26 · Vendor Advisory
• https://github.com/nyariv/SandboxJS · Note