CVE-2026-92935: vm2 Critical Vulnerability Allows Host RCE via NodeVM Nesting Guard Bypass
Summary
CVE-2026-92935: vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE. Affects vm2 versions >= 3.11.4, < 3.11.7. Fixed in 3.11.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vm2 is a popular Node.js library that provides a sandboxed environment for executing JavaScript code securely. It allows developers to run untrusted code while controlling the environment and restricting access to the host system. However, a critical vulnerability has been identified in the NodeVM constructor, which can lead to remote code execution (RCE) if not addressed.
Vulnerability Detail
The vulnerability arises from the NodeVM constructor's handling of the 'requireOpts' parameter. Specifically, it incorrectly allows an array-shaped 'require' configuration to bypass the nesting guard, which is designed to prevent unauthorized nesting of NodeVM instances. This flaw enables an attacker to execute arbitrary commands within the host Node.js process, potentially leading to severe consequences such as data breaches, unauthorized access to system resources, and manipulation of files. The vulnerability is particularly dangerous because it allows attackers to load the host vm2 module and create inner NodeVM instances with custom configurations, effectively compromising the host's security.
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.11.7
This is the first release that contains the fix.
npm install vm2@3.11.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the 'nesting' option with an array-shaped 'require' configuration in your NodeVM instances. Instead, use a valid object configuration for 'require' to prevent the vulnerability from being exploited.
Conclusion
The vm2 package has a critical vulnerability (CVE-2026-92935) that allows for remote code execution due to improper handling of the 'require' configuration in the NodeVM constructor. It is essential to update to the patched version (3.11.7 or later) to protect your application from potential exploitation.
See every vulnerability recorded for vm2 →
FAQ
The CVSS score of this vulnerability is 9.0, indicating a critical severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
An attacker can execute arbitrary commands with the host Node.js process privileges, which may lead to data breaches, unauthorized access to sensitive information, and manipulation of system files.
Yes, versions of vm2 up to 3.11.6 are vulnerable. It is recommended to update to version 3.11.7 or later.
If you cannot update the package immediately, ensure that you do not use the 'nesting' option with an array-shaped 'require' configuration to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
