CVE-2026-92954: vm2 Package Vulnerability Leading to Host Process Termination
Summary
CVE-2026-92954: vm2 current head (v3.11.5, commit 7a1f5100b96f48d34e0fe104ab37c0acc5944f92) can still be used to terminate the host Node.js process when sandbox code calls a host-realm function that returns a rejected host Promise and t... Affects vm2 versions >= 3.10.0, < 3.11.8. Fixed in 3.11.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
vm2 is a popular Node.js package that provides a sandboxed environment for executing untrusted code securely. It allows developers to run JavaScript code in a controlled context, preventing access to the host environment. However, certain configurations can expose the host process to risks, particularly when handling promises returned from host-realm functions.
Vulnerability Detail
The vulnerability in vm2 arises from its handling of host-returned promises. When sandbox code calls a host function that returns a rejected promise and does not handle it, the default behavior of Node.js leads to the termination of the host process. This issue is a variant of a previous unhandled rejection hardening fix and can be exploited by attackers to crash the host application, especially in multi-tenant environments where a single request can disrupt service for all users.
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.11.8
This is the first release that contains the fix.
npm install vm2@3.11.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can attach a .catch() handler to any promises returned from host functions to prevent unhandled rejections from terminating the host process. For example:
const vm = new VM({
sandbox: {
hostReject: () => Promise.reject(new Error('host-boom')),
},
});
vm.run('hostReject().catch(() => {});');
Conclusion
The vm2 package vulnerability CVE-2026-92954 poses a significant risk to applications that utilize this package for sandboxing untrusted code. By updating to the patched version and implementing recommended workarounds, developers can mitigate the risk of host process termination due to unhandled promise rejections.
See every vulnerability recorded for vm2 →
FAQ
CVE-2026-92954 is a vulnerability in the vm2 package that allows unhandled promise rejections from host functions to terminate the host Node.js process.
If your application uses vm2 and exposes host functions that return promises, an attacker could exploit this vulnerability to crash your application, leading to service disruptions.
Versions of vm2 from 3.10.0 to 3.11.7 are affected. It is recommended to upgrade to version 3.11.8 or later.
The CVSS score for this vulnerability is 8.6, indicating a high level of severity.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application by visiting the Vulert playground at Vulert Scanner without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
