{"id":"EUVD-2026-19299","enisaUuid":"327e741d-f9e3-3a71-b1f5-fc58bec9429f","description":"SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, the @nyariv/sandboxjs parser contains unbounded recursion in the restOfExp function and the lispify/lispifyExpr call chain. An attacker can crash any Node.js process that parses untrusted input by supplying deeply nested expressions (e.g., ~2000 nested parentheses), causing a RangeError: Maximum call stack size exceeded that terminates the process. This vulnerability is fixed in 0.8.36.","datePublished":"Apr 6, 2026, 3:10:42 PM","dateUpdated":"Apr 7, 2026, 2:09:53 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/nyariv/SandboxJS/security/advisories/GHSA-8pfc-jjgw-6g26\n","aliases":"CVE-2026-34211\nGHSA-8pfc-jjgw-6g26\n","assigner":"GitHub_M","epss":0.4,"enisaIdProduct":[{"id":"2f7de45b-220f-3332-abc9-2411ece8064d","product":{"name":"sandboxjs","vendor":{"name":"nyariv"}},"product_version":"\u003c 0.8.36"}],"enisaIdVendor":[{"id":"1a4142d7-18d2-3015-811d-c4439e3eccf6","vendor":{"name":"nyariv"}}],"enisaIdVulnerability":[{"id":"02802b41-30bf-3afc-bbae-6386df31ce69","vulnerability":{"id":"CVE-2026-34211","description":"SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, the @nyariv/sandboxjs parser contains unbounded recursion in the restOfExp function and the lispify/lispifyExpr call chain. An attacker can crash any Node.js process that parses untrusted input by supplying deeply nested expressions (e.g., ~2000 nested parentheses), causing a RangeError: Maximum call stack size exceeded that terminates the process. This vulnerability is fixed in 0.8.36.","datePublished":"Apr 6, 2026, 3:10:42 PM","dateUpdated":"Apr 7, 2026, 2:09:53 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/nyariv/SandboxJS/security/advisories/GHSA-8pfc-jjgw-6g26\n","enisa_id":"EUVD-2026-19299\n","assigner":"GitHub_M","epss":0.4,"dataProcessed":"Nov 1, 2026, 7:19:35 AM","vulnerabilityProduct":[{"id":"ce13dfcc-dfd8-3fcb-91df-5417f6de5e1a","product":{"name":"sandboxjs","vendor":{"name":"nyariv"}},"product_version":"\u003c 0.8.36"}],"vulnerabilityVendor":[{"id":"f00c352a-f196-3c98-b895-5b66d83db181","vendor":{"name":"nyariv"}}]}},{"id":"03f70590-d62c-3de7-a641-182553306ec9","vulnerability":{"id":"GHSA-8pfc-jjgw-6g26","description":"SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parser","datePublished":"Apr 3, 2026, 9:45:14 PM","dateUpdated":"Apr 6, 2026, 11:18:26 PM","baseScore":0.0,"references":"https://github.com/nyariv/SandboxJS/security/advisories/GHSA-8pfc-jjgw-6g26\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-34211\nhttps://github.com/nyariv/SandboxJS\n","enisa_id":"EUVD-2026-19299\n","aliases":"GHSA-8pfc-jjgw-6g26\nCVE-2026-34211\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:59:37 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}