CVE-2026-92942: vm2 Timeout Option Bypass Leading to Unbounded Host Event-Loop Block
Summary
CVE-2026-92942: vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block). Affects vm2 versions < 3.11.7. Fixed in 3.11.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vm2 is a popular Node.js package that provides a sandboxed environment for executing untrusted code securely. It allows developers to run scripts in a controlled context, limiting their access to the host environment. However, the package has a vulnerability related to its timeout feature, which is supposed to restrict the execution time of sandboxed code. This vulnerability can lead to denial of service by allowing untrusted scripts to run indefinitely, causing the host event loop to block.
Vulnerability Detail
The vulnerability arises from the way vm2 handles the timeout option. The timeout only applies to the immediate execution of the VM#run() method and does not account for asynchronous callbacks triggered by the V8 garbage collector, such as those registered with FinalizationRegistry. This means that a malicious script can register a callback that runs long after the VM#run() method has returned, effectively bypassing the timeout and potentially freezing the entire Node.js process. The issue is exacerbated by the fact that FinalizationRegistry and WeakRef are exposed to sandboxed code without any restrictions, allowing attackers to exploit this behavior easily.
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.11.7
This is the first release that contains the fix.
npm install vm2@3.11.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can remove FinalizationRegistry and WeakRef from the sandbox global scope by modifying the setup code in lib/setup-sandbox.js. This can be done by adding the following lines:
const { VM } = require('vm2');
const vm = new VM({
sandbox: {
FinalizationRegistry: undefined,
WeakRef: undefined
}
});
This will prevent untrusted scripts from accessing these potentially dangerous features.
Conclusion
The vm2 package has a significant vulnerability that allows untrusted code to bypass execution time limits, potentially leading to denial of service. It is crucial to update to the patched version 3.11.7 or later to secure your application. Additionally, consider implementing the suggested workaround if immediate updates are not feasible.
See every vulnerability recorded for vm2 →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
FinalizationRegistry and WeakRef are JavaScript features that allow developers to manage memory more efficiently. However, they can also be exploited in a sandboxed environment to bypass execution time limits.
If left unaddressed, this vulnerability can lead to denial of service, where untrusted scripts can block the event loop indefinitely, affecting the performance and reliability of your application.
Yes, you can temporarily mitigate the risk by removing FinalizationRegistry and WeakRef from the sandbox global scope, as described in the workaround section.
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
