Nyariv Sandboxjs vulnerabilities

• nyariv sandboxjs SandboxJS: Sandbox escape via Function.caller leakage of internal call op CVE-2026-43898 Fix available 10.0 CriticalMay 11, 2026
• nyariv sandboxjs SandboxJS has a Sandbox Escape via Prop Object Leak in New Handler CVE-2026-34217 Fix available 6.9 MediumApril 3, 2026
• nyariv sandboxjs SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parser CVE-2026-34211 Fix available 6.9 MediumApril 3, 2026
• nyariv sandboxjs SandboxJS: Sandbox integrity escape CVE-2026-34208 Fix available 10.0 CriticalApril 3, 2026
• nyariv sandboxjs SandboxJS timers have an execution-quota bypass (cross-sandbox currentTicks race) CVE-2026-32723 Fix available 4.8 MediumMarch 16, 2026
• nyariv sandboxjs SandboxJS has a Sandbox Escape CVE-2026-26954 Fix available 10.0 CriticalMarch 13, 2026
• nyariv sandboxjs @nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape) CVE-2026-25881 Fix available 9.1 CriticalFebruary 9, 2026
• nyariv sandboxjs SandboxJS has a sandbox escape via TOCTOU bug on keys in property accesses CVE-2026-25641 Fix available 10.0 CriticalFebruary 5, 2026
• nyariv sandboxjs SandboxJS has a Sandbox Escape CVE-2026-25587 Fix available 10.0 CriticalFebruary 5, 2026
• nyariv sandboxjs SandboxJS has a Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution CVE-2026-25586 Fix available 10.0 CriticalFebruary 5, 2026
• nyariv sandboxjs SandboxJS has a Sandbox Escape CVE-2026-25520 Fix available 10.0 CriticalFebruary 5, 2026
• nyariv sandboxjs SandboxJS Prototype Pollution -> Sandbox Escape -> RCE CVE-2026-25142 Fix available 10.0 CriticalFebruary 2, 2026
• nyariv sandboxjs SandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructor CVE-2026-23830 Public exploitFix available 10.0 CriticalJanuary 27, 2026
• nyariv sandboxjs nyariv sandboxjs 0.8.23 Prototype Pollution Sandbox Escape DoS CVE-2025-34146 Fix available 7.0 HighJuly 31, 2025