CVE-2026-100722: vm2 Package Host Promise Rejection Can Terminate Host Process
Summary
CVE-2026-100722: vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process. Affects vm2 versions < 3.12.2. Fixed in 3.12.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vm2 package is a widely used Node.js library that provides a sandboxed environment for executing untrusted JavaScript code. It allows developers to run scripts in a secure manner, isolating them from the host environment. However, the package has a vulnerability that can lead to host process termination when an untrusted script constructs a Promise-returning host function that rejects without proper handling.
Vulnerability Detail
The vulnerability arises from the way the vm2 package handles Promise rejections from exposed host functions. When an untrusted script creates a host function that returns a rejected Promise, the rejection is not properly handled, leading to the termination of the Node.js process. This occurs because the construct trap in the sandbox does not apply the same rejection handling as the apply trap, allowing unhandled rejections to propagate and crash the host process. The issue is particularly critical as it can be exploited by attackers to disrupt services that rely on the vm2 package, such as plugin workers or multi-tenant execution environments.
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid exposing host functions that return rejected Promises to untrusted scripts. Additionally, ensure that any host functions that may return Promises are designed to handle rejections appropriately within the sandbox.
Conclusion
The vm2 package has a critical vulnerability (CVE-2026-100722) that can lead to the termination of the host process due to unhandled Promise rejections. It is essential for developers using this package to update to the latest version to mitigate risks and ensure the stability of their applications.
See every vulnerability recorded for vm2 →
FAQ
The CVSS score of this vulnerability is 8.6, indicating a high severity level.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check if your application is affected without requiring any signup.
An attacker can exploit this vulnerability to terminate the Node.js process hosting the vm2 sandbox, leading to service disruptions and availability issues.
Yes, avoid exposing host functions that can return rejected Promises to untrusted scripts and ensure proper rejection handling within the sandbox.
The affected version is 3.11.8. Versions 3.12.2 and later contain the necessary fixes.
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
