CVE-2026-92952: vm2 Incomplete Node.js Symbol Filtering Vulnerability
Summary
CVE-2026-92952: vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks. Affects vm2 versions >= 3.11.4, < 3.11.7. Fixed in 3.11.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vm2 is a popular Node.js package that provides a sandboxed environment for executing JavaScript code securely. It allows developers to run untrusted code while maintaining control over the host environment. However, recent updates have revealed a vulnerability in the way vm2 handles Node.js internal symbols, specifically related to the WebStream API, which can lead to unauthorized access and manipulation of stream states.
Vulnerability Detail
The vulnerability arises from incomplete filtering of Node.js internal symbols within the vm2 sandbox. Specifically, the symbols 'nodejs.stream.disturbed' and 'nodejs.stream.errored' are exposed to sandboxed code, allowing attackers to manipulate the state of host WebStream objects. This can result in misleading behavior of stream state checks, such as making a stream appear undisturbed even after it has been read. The issue stems from a fixed list of dangerous symbols that does not account for these newer symbols, leading to potential security risks in applications relying on the integrity of stream states.
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.11.7
This is the first release that contains the fix.
npm install vm2@3.11.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid exposing host WebStream objects to the vm2 sandbox until the package is updated. This can be done by modifying your sandbox configuration to exclude these objects, thereby mitigating the risk of exploitation.
Conclusion
The vm2 package has a vulnerability related to incomplete filtering of Node.js internal symbols, which can lead to unauthorized access to WebStream states. It is essential to update to the latest version to ensure the security of applications using this package. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for vm2 →
FAQ
The CVSS score of this vulnerability is 6.8, indicating a moderate level of severity.
The affected versions of vm2 are 3.11.4, 3.11.5, and 3.11.6. It is recommended to update to version 3.11.7 or later.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By using the Vulert playground, you can check if your application is affected without any signup.
The vulnerability can lead to unauthorized manipulation of stream states, allowing attackers to bypass security checks and potentially compromise the integrity of data processing in applications.
Yes, a patch is available in version 3.11.7 of the vm2 package. It is crucial to update to this version to mitigate the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
