SandboxJS is a JavaScript sandboxing library that, before version 0.8.36, contains unbounded recursion in its parser. An attacker can submit deeply nested expressions (for example, about 2000 levels of parentheses) that cause the restOfExp function to recurse without limit. The stack overflow results in a RangeError: Maximum call stack size exceeded and terminates the Node.js process, interrupting any service that relies on the library. This weakness corresponds to uncontrolled recursion leading to stack overflow (CWE‑674).

All installations of the @nyariv/sandboxjs package with a version earlier than 0.8.36 that parse untrusted JavaScript expressions are affected. The vulnerability is fixed in version 0.8.36 and later.

The vulnerability carries a CVSS score of 6.9, indicating moderate severity, and an EPSS score of less than 1%, suggesting a low likelihood of exploitation. It is not listed in the CISA KEV catalog. An attacker only needs to provide malformed input that reaches the parser; no additional privileges or remote code execution are required. If the application uses the vulnerable sanitizer in a publicly reachable context, repeated use can lead to repeated crashes and downtime.