CVE-2026-92953: vm2 Package Vulnerability Allowing Host TypedArray and ArrayBuffer Intrinsics Mutation
Summary
CVE-2026-92953: vm2's current host-intrinsic prototype protection is incomplete. Affects vm2 versions >= 3.11.0, < 3.11.8. Fixed in 3.11.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The vm2 package is a popular Node.js library that provides a sandboxed environment for executing untrusted JavaScript code. It allows developers to run code securely without exposing the host environment. However, a recent vulnerability has been identified that compromises the integrity of this sandbox, allowing malicious code to mutate host TypedArray and ArrayBuffer prototypes.
Vulnerability Detail
The vulnerability arises from incomplete host-intrinsic prototype protection in vm2. While previous fixes addressed certain classic host intrinsics, the current implementation fails to protect TypedArray and ArrayBuffer prototypes. This allows sandboxed code to manipulate these prototypes, leading to potential integrity and availability issues. Attackers can exploit this vulnerability to install malicious properties and methods on host objects, affecting all instances of TypedArrays and ArrayBuffers created after the sandbox execution.
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.11.8
This is the first release that contains the fix.
npm install vm2@3.11.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the default VM configuration for executing untrusted code. Instead, consider using NodeVM, which provides more robust security features. Additionally, you can implement custom checks to validate the integrity of TypedArray and ArrayBuffer objects before use.
Conclusion
The vm2 package vulnerability CVE-2026-92953 poses a significant risk by allowing sandboxed code to mutate critical host prototypes. It is crucial for developers using this package to update to version 3.11.8 or later to ensure their applications remain secure. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for vm2 →
FAQ
The CVSS score of this vulnerability is 10.0, indicating a critical level of severity.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By simply providing your package-lock.json file, you can check for vulnerabilities without any installation. Visit the Vulert playground at Vulert Scanner.
TypedArrays and ArrayBuffers are JavaScript objects that allow for the manipulation of binary data. They are commonly used in applications that require efficient handling of raw binary data, such as image processing or WebGL.
The vulnerability can lead to unauthorized modifications of host TypedArray and ArrayBuffer prototypes, which may compromise the integrity of applications relying on these objects and potentially lead to data corruption or unexpected behavior.
While updating to the patched version is the best solution, you can temporarily mitigate the risk by avoiding the default VM configuration and using NodeVM instead.
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
