CVE-2026-34211: 
JavaScript vulnerability analysis and mitigation

CVE-2026-34211 is a Denial of Service vulnerability in the @nyariv/sandboxjs npm package caused by unbounded recursion in its recursive descent parser. Affected versions are all releases up to and including 0.8.35; the issue is patched in version 0.8.36. The vulnerability was published on April 3, 2026, and assigned a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 6.9 (Medium) (Github Advisory).

The root cause is uncontrolled recursion (CWE-674) in two locations within src/parser.ts: the restOfExp function (line 443/503) and the lispify → lispifyExpr → lispify call chain. Neither path implements a depth counter or limit check, so each nested bracket character ((, [, {) adds an unbounded stack frame. All public API methods — Sandbox.parse(), Sandbox.compile(), Sandbox.compileAsync(), Sandbox.compileExpression(), and Sandbox.compileExpressionAsync() — pass user input directly to the parser without any input validation or depth limiting. Supplying approximately 2,000 nested parentheses triggers a RangeError: Maximum call stack size exceeded, which in Node.js is not reliably catchable and can crash the entire server process (Github Advisory, SandboxJS Advisory).

Successful exploitation results in a complete availability loss for any Node.js server process that parses untrusted input using @nyariv/sandboxjs. Because SandboxJS is explicitly designed to execute untrusted JavaScript, its primary deployment scenario directly exposes applications to this attack. A single crafted request is sufficient to crash the host process, causing complete service disruption with no impact on confidentiality or integrity (Github Advisory).

A public proof-of-concept (PoC) exploit is available in the GitHub Security Advisory, consisting of a standalone Node.js script (poc.js) that triggers the crash with no external dependencies or authentication (SandboxJS Advisory). The attack requires no privileges, no user interaction, and is executable remotely over the network. The EPSS score is approximately 0.042% (0.000420), indicating low current exploitation probability. There is no evidence of in-the-wild exploitation or CISA KEV catalog listing at this time (Github Advisory).

1. Identify target: Locate a Node.js web application or service that uses @nyariv/sandboxjs version ≤ 0.8.35 to parse or evaluate user-supplied JavaScript expressions (e.g., a formula engine, template renderer, or sandboxed scripting endpoint).
2. Craft the payload: Construct a deeply nested expression string, such as '('.repeat(2000) + '1' + ')'.repeat(2000) or 'a' + '[0]'.repeat(2000), which creates approximately 2,000 levels of bracket nesting.
3. Submit the payload: Send the crafted string to any application endpoint that passes user input to Sandbox.compile(), Sandbox.parse(), Sandbox.compileExpression(), or their async equivalents.
4. Trigger stack overflow: The parser's restOfExp or lispify/lispifyExpr functions recurse without bound, exhausting the Node.js call stack and raising an uncatchable RangeError: Maximum call stack size exceeded.
5. Achieve DoS: The Node.js process crashes, causing complete service disruption for all users of the affected application (SandboxJS Advisory).

• Logs: Node.js process logs or application error logs containing RangeError: Maximum call stack size exceeded originating from @nyariv/sandboxjs parser functions (restOfExp, lispify, or lispifyExpr).
• Application Behavior: Sudden, unexpected crashes or restarts of Node.js server processes handling expression parsing or sandboxed script evaluation.
• Network: HTTP requests to expression evaluation or scripting endpoints containing payloads with a high ratio of repeated bracket characters (e.g., hundreds or thousands of consecutive (, ), [, ], {, } characters) (SandboxJS Advisory).

Upgrade @nyariv/sandboxjs to version 0.8.36 or later, which introduces depth limiting in the restOfExp, lispify, and lispifyExpr functions to prevent unbounded recursion (Github Advisory). As a temporary workaround prior to patching, implement server-side input validation to reject expressions exceeding a safe nesting depth or character length threshold before passing them to the SandboxJS API. Additionally, consider running the SandboxJS parser in a separate worker thread or child process so that a crash does not terminate the main application process.