CVE-2026-92944: vm2 Sandbox Escape Vulnerability in Node.js 26
Summary
CVE-2026-92944: vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector. Affects vm2 versions >= 3.10.2, < 3.11.7. Fixed in 3.11.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vm2 is a popular Node.js package that provides a sandboxed environment for executing untrusted JavaScript code securely. It allows developers to run scripts in a controlled context, ensuring that the code cannot access the host environment directly. However, a critical vulnerability has been identified in vm2 versions 3.10.2 through 3.11.5 when used with Node.js 26, which could allow an attacker to escape the sandbox and gain access to the host system.
Vulnerability Detail
The vulnerability arises from a flaw in how vm2 interacts with the Promise API in Node.js 26. Specifically, an attacker can exploit a stale PromiseThenLookupChain protector, allowing them to bypass vm2's security measures. This can lead to a situation where an attacker-controlled constructor can be used to access sensitive host objects, including the process object, potentially leading to arbitrary code execution with the privileges of the host Node.js process. The vulnerability is confirmed in multiple versions of vm2 and is particularly dangerous as it allows for direct access to the host environment.
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.11.7
This is the first release that contains the fix.
npm install vm2@3.11.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid using Node.js 26 with the affected versions of vm2. Alternatively, you can implement additional security measures to validate and sanitize inputs before executing them in the vm2 environment.
Conclusion
The vm2 sandbox escape vulnerability (CVE-2026-92944) poses a significant risk to applications using affected versions of the package on Node.js 26. It is crucial to update to the latest version to mitigate this risk and ensure the security of your application.
See every vulnerability recorded for vm2 →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical level of risk.
vm2 versions 3.10.2 through 3.11.5 are affected by this vulnerability.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. Check your application using the Vulert playground at Vulert Scanner.
An attacker could escape the vm2 sandbox and gain access to the host environment, potentially leading to arbitrary code execution and access to sensitive information.
While the best solution is to update to a patched version, you can temporarily avoid using Node.js 26 with the affected versions of vm2.
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
