CVE-2026-92939: vm2 Package Vulnerability Allows Arbitrary Native Code Execution via Crypto Module
Summary
CVE-2026-92939: vm2 crypto builtin loads attacker native code through setEngine. Affects vm2 versions >= 3.11.3, < 3.11.7. Fixed in 3.11.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vm2 package is a popular Node.js library that provides a sandboxed environment for executing untrusted JavaScript code. It allows developers to run code securely without exposing the host environment. However, the package has a vulnerability that exposes the host crypto module, which can lead to severe security risks if exploited.
Vulnerability Detail
The vulnerability in vm2 version 3.11.6 arises from the exposure of the host crypto module to a NodeVM when the crypto builtin is allowed. This allows an attacker to use the crypto.setEngine() function to load a malicious native library into the host process. The library's constructor executes before OpenSSL validates the file, leading to arbitrary native code execution with the host's privileges. This can result in unauthorized access to sensitive data, modification of application files, and other malicious actions.
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.11.7
This is the first release that contains the fix.
npm install vm2@3.11.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the crypto builtin in your vm2 configuration. This can be done by modifying your NodeVM setup to exclude the crypto module, thus preventing the execution of potentially harmful code.
Conclusion
The vm2 package vulnerability (CVE-2026-92939) poses a significant risk by allowing arbitrary native code execution through the exposed crypto module. It is crucial to update to the patched version (3.11.7) and consider workarounds to protect your application from potential exploitation.
See every vulnerability recorded for vm2 →
FAQ
The vulnerability allows attackers to execute arbitrary native code in the host process, which can lead to data theft, unauthorized access, and system compromise.
You can use Vulert to monitor your application for vulnerabilities. By analyzing your package-lock.json file, Vulert can alert you in real-time if your application is affected by this vulnerability.
Yes, a proof of concept is available that demonstrates how an attacker can exploit this vulnerability by loading a native library through the crypto.setEngine() function.
The CVSS score for this vulnerability is 9.9, indicating a critical level of severity.
If you cannot update the package right away, ensure that the crypto builtin is not included in your vm2 configuration to mitigate the risk until you can apply the update.
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
