A stack overflow occurs in the SandboxJS parser when it encounters deeply nested expressions during evaluation, causing a RangeError that terminates the Node.js process. The flaw is a classic instance of uncontrolled recursion as classified by CWE-674 and results in service disruption for any process that processes untrusted input through SandboxJS.

The vulnerability affects the Nyariv SandboxJS library prior to version 0.8.36. Any Node.js application that loads this library and parses user-supplied input is susceptible.

The CVSS score of 6.9 indicates moderate severity. No EPSS data is available, and the issue is not listed in the CISA KEV catalog. An attacker can exploit the flaw by sending a crafted payload containing a large number of nested parentheses or similar constructs, forcing the parser to recurse until the maximum call stack size is exceeded.