CVE-2026-34211: nyariv SandboxJS, отказ на услуга

Описание

Оригинално описание

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, the @nyariv/sandboxjs parser contains unbounded recursion in the restOfExp function and the lispify/lispifyExpr call chain. An attacker can crash any Node.js process that parses untrusted input by supplying deeply nested expressions (e.g., ~2000 nested parentheses), causing a RangeError: Maximum call stack size exceeded that terminates the process. This vulnerability is fixed in 0.8.36.

Засегнати продукти

• nyariv SandboxJS: < 0.8.36

Вид слабост

• CWE-674 Uncontrolled Recursion

История

Други уязвимости в nyariv SandboxJS

• 10.0CVE-2026-43898
• 6.9CVE-2026-34217
• 10.0CVE-2026-34208
• 4.8CVE-2026-32723
• 10.0CVE-2026-26954

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-34211
• https://nvd.nist.gov/vuln/detail/CVE-2026-34211
• https://github.com/nyariv/SandboxJS/security/advisories/GHSA-8pfc-jjgw-6g26