CVE-2026-92959: vm2 Package Asynchronous Code Execution Bypass Vulnerability
Summary
CVE-2026-92959: vm2: allowAsync: false can be bypassed through Promise thenable assimilation in VM and NodeVM. Affects vm2 versions < 3.11.8. Fixed in 3.11.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vm2 package is a popular Node.js library that provides a sandboxed environment for executing JavaScript code securely. It allows developers to run untrusted code with restrictions, ensuring that the code cannot access the host environment directly. The package is widely used in applications that require safe execution of user-provided scripts. However, a vulnerability has been identified that allows asynchronous code execution even when the 'allowAsync' option is set to false, potentially leading to security breaches.
Vulnerability Detail
The vulnerability arises from the improper handling of Promise static methods in the vm2 package. When 'allowAsync' is set to false, the expectation is that any attempt to execute asynchronous code will be blocked. However, the implementation fails to neutralize attacker-controlled thenables created through Promise static methods like Promise.resolve, Promise.all, and others. This allows malicious code to execute after the VM.run() method has returned, bypassing the intended restrictions and potentially leading to denial of service or other malicious actions.
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.11.8
This is the first release that contains the fix.
npm install vm2@3.11.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using Promise static methods (e.g., Promise.resolve, Promise.all) in your sandboxed code when 'allowAsync' is set to false. Instead, consider using synchronous alternatives or refactoring the code to eliminate the need for asynchronous operations in the sandbox.
Conclusion
The vm2 package has a significant vulnerability that allows asynchronous code execution even when it is not intended. It is crucial for developers using this package to update to the latest version to mitigate the risks associated with this vulnerability. Implementing the suggested workarounds can provide temporary relief until an update can be applied.
See every vulnerability recorded for vm2 →
FAQ
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
If your application uses the vm2 package with 'allowAsync' set to false, it may be vulnerable to unauthorized asynchronous code execution, which can lead to security risks.
If an immediate update is not possible, implement the suggested workaround by avoiding the use of Promise static methods in your sandboxed code.
You can find more information in the official GitHub advisory for CVE-2026-92959 or by visiting the vm2 package repository.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
