npmPackage

@nyariv/sandboxjs

14 known vulnerabilities (10 critical, 1 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release: 0.9.7 (Aug 22, 2026): no advisory affects it
Newest unaffected release: 0.9.7 (Aug 22, 2026), the latest release
Advisories: 14 · 10 critical, 1 high, 3 medium

Weekly downloads: 114K
Dependents: 3
Releases: 81 since 0.1.0 (Mar 10, 2020)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-43898
Affects 0.1.0 to 0.9.5 (0.9.6 is outside it)
CVE-2026-34217
Affects 0.1.0 to 0.8.35 (0.8.36 is outside it)
CVE-2026-34211
Affects 0.1.0 to 0.8.35 (0.8.36 is outside it)
CVE-2026-34208
Affects 0.1.0 to 0.8.35 (0.8.36 is outside it)
CVE-2026-32723
Affects 0.1.0 to 0.8.34 (0.8.35 is outside it)
CVE-2026-26954
Affects 0.1.0 to 0.8.33 (0.8.34 is outside it)
CVE-2026-25881
Affects 0.1.0 to 0.8.30 (0.8.31 is outside it)
CVE-2026-25586
Affects 0.1.0 to 0.8.28 (0.8.29 is outside it)
CVE-2026-25520
Affects 0.1.0 to 0.8.28 (0.8.29 is outside it)
CVE-2026-25587
Affects 0.1.0 to 0.8.28 (0.8.29 is outside it)
CVE-2026-25641
Affects 0.1.0 to 0.8.28 (0.8.29 is outside it)
CVE-2026-25142
Affects 0.1.0 to 0.8.26 (0.8.27 is outside it)

Show all 14 advisoriesShow fewer advisories

CVE-2026-23830
Affects 0.1.0 to 0.8.25 (0.8.26 is outside it)
CVE-2025-34146
Affects 0.1.0 to 0.8.23 (0.8.24 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 14

CVE-2026-43898Critical 10.0
SandboxJS: Sandbox escape via Function.caller leakage of internal call op
Affected: fixed in 0.9.6.
Fixed in 0.9.6 (released May 9, 2026, 19 days before disclosure).
The latest release, 0.9.7, is not affected.
61% of @nyariv/sandboxjs downloads last week were affected versions (82.5K).
CVE-2026-34217Medium 6.9
SandboxJS has a Sandbox Escape via Prop Object Leak in New Handler
Affected: fixed in 0.8.36.
Fixed in 0.8.36 (released Apr 3, 2026, 3 days before disclosure).
The latest release, 0.9.7, is not affected.
60% of @nyariv/sandboxjs downloads last week were affected versions (80.6K).
CVE-2026-34211Medium 6.9
SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parser
Affected: fixed in 0.8.36.
Fixed in 0.8.36 (released Apr 3, 2026, 3 days before disclosure).
The latest release, 0.9.7, is not affected.
60% of @nyariv/sandboxjs downloads last week were affected versions (80.6K).
CVE-2026-34208Critical 10.0
SandboxJS: Sandbox integrity escape
Affected: fixed in 0.8.36.
Fixed in 0.8.36 (released Apr 3, 2026, 3 days before disclosure).
The latest release, 0.9.7, is not affected.
60% of @nyariv/sandboxjs downloads last week were affected versions (80.6K).
CVE-2026-32723Medium 4.8
SandboxJS timers have an execution-quota bypass (cross-sandbox currentTicks race)
Affected: fixed in 0.8.35.
Fixed in 0.8.35 (released Mar 14, 2026, 4 days before disclosure).
The latest release, 0.9.7, is not affected.
60% of @nyariv/sandboxjs downloads last week were affected versions (80K).
CVE-2026-26954Critical 10.0
SandboxJS has a Sandbox Escape
Affected: fixed in 0.8.34.
Fixed in 0.8.34 (released Mar 13, 2026, the day of disclosure).
The latest release, 0.9.7, is not affected.
60% of @nyariv/sandboxjs downloads last week were affected versions (80K).
CVE-2026-25881Critical 9.1
@nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape)
Affected: fixed in 0.8.31.
Fixed in 0.8.31 (released Feb 8, 2026, 1 day before disclosure).
The latest release, 0.9.7, is not affected.
59% of @nyariv/sandboxjs downloads last week were affected versions (79.8K).
CVE-2026-25586Critical 10.0
SandboxJS has a Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution
Affected: fixed in 0.8.29.
Fixed in 0.8.29 (released Feb 5, 2026, 1 day before disclosure).
The latest release, 0.9.7, is not affected.
59% of @nyariv/sandboxjs downloads last week were affected versions (79.6K).
CVE-2026-25520Critical 10.0
SandboxJS has a Sandbox Escape
Affected: fixed in 0.8.29.
Fixed in 0.8.29 (released Feb 5, 2026, 1 day before disclosure).
The latest release, 0.9.7, is not affected.
59% of @nyariv/sandboxjs downloads last week were affected versions (79.6K).
CVE-2026-25587Critical 10.0
SandboxJS has a Sandbox Escape
Affected: fixed in 0.8.29.
Fixed in 0.8.29 (released Feb 5, 2026, 1 day before disclosure).
The latest release, 0.9.7, is not affected.
59% of @nyariv/sandboxjs downloads last week were affected versions (79.6K).
CVE-2026-25641Critical 10.0
SandboxJS has a sandbox escape via TOCTOU bug on keys in property accesses
Affected: fixed in 0.8.29.
Fixed in 0.8.29 (released Feb 5, 2026, 1 day before disclosure).
The latest release, 0.9.7, is not affected.
59% of @nyariv/sandboxjs downloads last week were affected versions (79.6K).
CVE-2026-25142Critical 10.0
SandboxJS Prototype Pollution -> Sandbox Escape -> RCE
Affected: fixed in 0.8.27.
Fixed in 0.8.27 (released Jan 31, 2026, 2 days before disclosure).
The latest release, 0.9.7, is not affected.
59% of @nyariv/sandboxjs downloads last week were affected versions (79.5K).
CVE-2026-23830Critical 10.0
SandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructor
Affected: fixed in 0.8.26.
Fixed in 0.8.26 (released Jan 27, 2026, the day of disclosure).
The latest release, 0.9.7, is not affected.
59% of @nyariv/sandboxjs downloads last week were affected versions (79.4K).
CVE-2025-34146High 7.0
nyariv sandboxjs 0.8.23 Prototype Pollution Sandbox Escape DoS
Affected: fixed in 0.8.24.
Fixed in 0.8.24 (released Apr 25, 2025, 97 days before disclosure).
The latest release, 0.9.7, is not affected.
2.4% of @nyariv/sandboxjs downloads last week were affected versions (3.2K).