# @nyariv/sandboxjs (npm) vulnerabilities 14 known vulnerabilities (10 critical, 1 high, 3 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 0.9.7 (Aug 22, 2026): no advisory affects it - Newest unaffected release: 0.9.7 (Aug 22, 2026), the latest release - Weekly downloads: 114K - Dependents: 3 - Releases: 81 since 0.1.0 (Mar 10, 2020) - Registry: https://www.npmjs.com/package/@nyariv/sandboxjs - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-43898: 0.1.0 to 0.9.5 (0.9.6 is outside it) - CVE-2026-34217: 0.1.0 to 0.8.35 (0.8.36 is outside it) - CVE-2026-34211: 0.1.0 to 0.8.35 (0.8.36 is outside it) - CVE-2026-34208: 0.1.0 to 0.8.35 (0.8.36 is outside it) - CVE-2026-32723: 0.1.0 to 0.8.34 (0.8.35 is outside it) - CVE-2026-26954: 0.1.0 to 0.8.33 (0.8.34 is outside it) - CVE-2026-25881: 0.1.0 to 0.8.30 (0.8.31 is outside it) - CVE-2026-25586: 0.1.0 to 0.8.28 (0.8.29 is outside it) - CVE-2026-25520: 0.1.0 to 0.8.28 (0.8.29 is outside it) - CVE-2026-25587: 0.1.0 to 0.8.28 (0.8.29 is outside it) - CVE-2026-25641: 0.1.0 to 0.8.28 (0.8.29 is outside it) - CVE-2026-25142: 0.1.0 to 0.8.26 (0.8.27 is outside it) - CVE-2026-23830: 0.1.0 to 0.8.25 (0.8.26 is outside it) - CVE-2025-34146: 0.1.0 to 0.8.23 (0.8.24 is outside it) ## Advisories (14) ### [CVE-2026-43898](https://cve.now/CVE-2026-43898): SandboxJS: Sandbox escape via Function.caller leakage of internal call op - Severity: Critical 10.0 - Published: May 28, 2026 - Affected: fixed in 0.9.6. - Fixed in 0.9.6 (released May 9, 2026, 19 days before disclosure). - The latest release, 0.9.7, is not affected. - 61% of @nyariv/sandboxjs downloads last week were affected versions (82.5K). ### [CVE-2026-34217](https://cve.now/CVE-2026-34217): SandboxJS has a Sandbox Escape via Prop Object Leak in New Handler - Severity: Medium 6.9 - Published: Apr 6, 2026 - Affected: fixed in 0.8.36. - Fixed in 0.8.36 (released Apr 3, 2026, 3 days before disclosure). - The latest release, 0.9.7, is not affected. - 60% of @nyariv/sandboxjs downloads last week were affected versions (80.6K). ### [CVE-2026-34211](https://cve.now/CVE-2026-34211): SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parser - Severity: Medium 6.9 - Published: Apr 6, 2026 - Affected: fixed in 0.8.36. - Fixed in 0.8.36 (released Apr 3, 2026, 3 days before disclosure). - The latest release, 0.9.7, is not affected. - 60% of @nyariv/sandboxjs downloads last week were affected versions (80.6K). ### [CVE-2026-34208](https://cve.now/CVE-2026-34208): SandboxJS: Sandbox integrity escape - Severity: Critical 10.0 - Published: Apr 6, 2026 - Affected: fixed in 0.8.36. - Fixed in 0.8.36 (released Apr 3, 2026, 3 days before disclosure). - The latest release, 0.9.7, is not affected. - 60% of @nyariv/sandboxjs downloads last week were affected versions (80.6K). ### [CVE-2026-32723](https://cve.now/CVE-2026-32723): SandboxJS timers have an execution-quota bypass (cross-sandbox currentTicks race) - Severity: Medium 4.8 - Published: Mar 18, 2026 - Affected: fixed in 0.8.35. - Fixed in 0.8.35 (released Mar 14, 2026, 4 days before disclosure). - The latest release, 0.9.7, is not affected. - 60% of @nyariv/sandboxjs downloads last week were affected versions (80K). ### [CVE-2026-26954](https://cve.now/CVE-2026-26954): SandboxJS has a Sandbox Escape - Severity: Critical 10.0 - Published: Mar 13, 2026 - Affected: fixed in 0.8.34. - Fixed in 0.8.34 (released Mar 13, 2026, the day of disclosure). - The latest release, 0.9.7, is not affected. - 60% of @nyariv/sandboxjs downloads last week were affected versions (80K). ### [CVE-2026-25881](https://cve.now/CVE-2026-25881): @nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape) - Severity: Critical 9.1 - Published: Feb 9, 2026 - Affected: fixed in 0.8.31. - Fixed in 0.8.31 (released Feb 8, 2026, 1 day before disclosure). - The latest release, 0.9.7, is not affected. - 59% of @nyariv/sandboxjs downloads last week were affected versions (79.8K). ### [CVE-2026-25586](https://cve.now/CVE-2026-25586): SandboxJS has a Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution - Severity: Critical 10.0 - Published: Feb 6, 2026 - Affected: fixed in 0.8.29. - Fixed in 0.8.29 (released Feb 5, 2026, 1 day before disclosure). - The latest release, 0.9.7, is not affected. - 59% of @nyariv/sandboxjs downloads last week were affected versions (79.6K). ### [CVE-2026-25520](https://cve.now/CVE-2026-25520): SandboxJS has a Sandbox Escape - Severity: Critical 10.0 - Published: Feb 6, 2026 - Affected: fixed in 0.8.29. - Fixed in 0.8.29 (released Feb 5, 2026, 1 day before disclosure). - The latest release, 0.9.7, is not affected. - 59% of @nyariv/sandboxjs downloads last week were affected versions (79.6K). ### [CVE-2026-25587](https://cve.now/CVE-2026-25587): SandboxJS has a Sandbox Escape - Severity: Critical 10.0 - Published: Feb 6, 2026 - Affected: fixed in 0.8.29. - Fixed in 0.8.29 (released Feb 5, 2026, 1 day before disclosure). - The latest release, 0.9.7, is not affected. - 59% of @nyariv/sandboxjs downloads last week were affected versions (79.6K). ### [CVE-2026-25641](https://cve.now/CVE-2026-25641): SandboxJS has a sandbox escape via TOCTOU bug on keys in property accesses - Severity: Critical 10.0 - Published: Feb 6, 2026 - Affected: fixed in 0.8.29. - Fixed in 0.8.29 (released Feb 5, 2026, 1 day before disclosure). - The latest release, 0.9.7, is not affected. - 59% of @nyariv/sandboxjs downloads last week were affected versions (79.6K). ### [CVE-2026-25142](https://cve.now/CVE-2026-25142): SandboxJS Prototype Pollution -\> Sandbox Escape -\> RCE - Severity: Critical 10.0 - Published: Feb 2, 2026 - Affected: fixed in 0.8.27. - Fixed in 0.8.27 (released Jan 31, 2026, 2 days before disclosure). - The latest release, 0.9.7, is not affected. - 59% of @nyariv/sandboxjs downloads last week were affected versions (79.5K). ### [CVE-2026-23830](https://cve.now/CVE-2026-23830): SandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructor - Severity: Critical 10.0 - Published: Jan 27, 2026 - Affected: fixed in 0.8.26. - Fixed in 0.8.26 (released Jan 27, 2026, the day of disclosure). - The latest release, 0.9.7, is not affected. - 59% of @nyariv/sandboxjs downloads last week were affected versions (79.4K). ### [CVE-2025-34146](https://cve.now/CVE-2025-34146): nyariv sandboxjs 0.8.23 Prototype Pollution Sandbox Escape DoS - Severity: High 7.0 - Published: Jul 31, 2025 - Affected: fixed in 0.8.24. - Fixed in 0.8.24 (released Apr 25, 2025, 97 days before disclosure). - The latest release, 0.9.7, is not affected. - 2.4% of @nyariv/sandboxjs downloads last week were affected versions (3.2K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/@nyariv/sandboxjs Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.