VulertSecurity VulertSecurity

Vulnerability Database · npm · vm2 · Version

vm2 3.6.10

3.6.10 is affected by 77 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 3.12.2.

Critical 47 High 17 Medium 11 Low 2 Unrated 0

All vm2 versions & vulnerabilities → Source repository Search the database for this package →
Released 28 Jan 2019 Status deprecated release Licence MIT Also known from other sources 61 Newer releases 83 Database updated 23/Oct/2026

Release and licence data published by the npm registry. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

vm2 3.6.10 vulnerabilities

77 vulnerabilities cover vm2 3.6.10. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2026-93605: vm2 Sandbox Escape Vulnerability Allows Host Command Execution 10.0 critical 3.12.1 07 Oct 2026
CVE-2026-100721: vm2 Critical Authorization Bypass Vulnerability 10.0 critical 3.12.2 05 Oct 2026
CVE-2026-100723: vm2 Package Vulnerability Exposes Host Memory via zlib Buffers 10.0 medium 3.12.2 05 Oct 2026
CVE-2026-92955: vm2 Sandbox Escape Vulnerability 10.0 critical 3.11.8 05 Oct 2026
CVE-2026-92946: vm2 Critical RCE Vulnerability via Unrestricted Host Filesystem Access 10.0 critical 3.11.7 05 Oct 2026
CVE-2026-92947: vm2 Package Vulnerability Allows Sandboxed Code to Access Host Memory 10.0 critical 3.11.7 05 Oct 2026
Critical Sandbox Escape Vulnerability in vm2 Package 10.0 critical 3.12.1 18 Sep 2026
Critical Sandbox Escape Vulnerability in vm2 Package 10.0 critical No fix published 17 Sep 2026
Critical Memory Exposure Vulnerability in vm2 Package 10.0 critical No fix published 17 Sep 2026
Critical Remote Code Execution Vulnerability in vm2 Package 10.0 critical No fix published 17 Sep 2026
Critical Remote Code Execution Vulnerability in vm2 Package 10.0 critical No fix published 17 Sep 2026
Critical Vulnerability in vm2: Process-wide Observability Exposing Host Information 10.0 critical 3.11.6 17 Aug 2026
CVE-2026-47140: vm2 Package Denylist Bypass Vulnerability Leading to Host Code Execution 10.0 critical 3.11.4 29 May 2026
CVE-2026-47137: vm2 Remote Code Execution Vulnerability Due to Patch Bypass 10.0 critical 3.11.4 29 May 2026
CVE-2026-47208: vm2 Sandbox Breakout Vulnerability via Promise Species Manipulation 10.0 critical 3.11.4 29 May 2026
CVE-2026-47131: vm2 Package Sandbox Escape Vulnerability 10.0 critical 3.11.4 29 May 2026
CVE-2026-43997: vm2 Package Sandbox Escape Vulnerability 10.0 critical 3.11.0 07 May 2026
CVE-2026-44006: vm2 Sandbox Escape Vulnerability Leading to Remote Code Execution 10.0 critical 3.11.0 07 May 2026
CVE-2022-36067: vm2 Sandbox Escape Remote Code Execution 10.0 critical 3.9.11 28 Sep 2022
CVE-2026-92951: vm2 Package Allows Bypass of External Package Allowlist via Colliding Host Package 9.9 critical 3.11.7 01 Oct 2026
CVE-2026-92957: vm2 Package NodeVM Builtin Deny Bypass Vulnerability 9.9 critical 3.11.7 01 Oct 2026
Critical Authorization Bypass in vm2 Package: External Package Allowlist Vulnerability 9.9 critical No fix published 17 Sep 2026
Critical Bypass Vulnerability in vm2 Package Exposes Child Process APIs 9.9 critical No fix published 17 Sep 2026
CVE-2026-47686: VM2 Missing Error.cause Sanitization Leading to Remote Code Execution 9.9 critical 3.11.6 17 Aug 2026
CVE-2026-47698: vm2 Sandbox Breakout Vulnerability Allowing Remote Code Execution 9.8 critical 3.11.6 17 Aug 2026
CVE-2026-47210: vm2 Sandbox Escape via JSPI-backed Promise .finally() Species Bypass 9.8 critical 3.11.4 29 May 2026
CVE-2026-45411: vm2 Sandbox Breakout Vulnerability via Async Generator 9.8 critical 3.11.3 14 May 2026
CVE-2026-44009: vm2 Sandbox Breakout Vulnerability Leading to Remote Code Execution 9.8 critical 3.11.2 08 May 2026
CVE-2026-44008: vm2 Sandbox Breakout Vulnerability via neutralizeArraySpeciesBatch 9.8 critical 3.11.2 08 May 2026
CVE-2026-26332: VM2 Sandbox Escape via SuppressedError Vulnerability 9.8 critical 3.11.0 05 May 2026
CVE-2026-24781: VM2 Sandbox Breakout Vulnerability via Inspect Function 9.8 critical 3.11.0 05 May 2026
CVE-2026-24120: VM2 Sandbox Breakout Through Promise Species Vulnerability 9.8 critical 3.10.5 05 May 2026
CVE-2026-24118: VM2 Sandbox Breakout via __lookupGetter__ Method 9.8 critical 3.11.0 04 May 2026
CVE-2026-22709: vm2 Sandbox Escape Vulnerability 9.8 critical 3.10.2 26 Jan 2026
CVE-2023-37466: vm2 Sandbox Escape vulnerability 9.8 critical No fix published 13 Jul 2023
CVE-2023-37903: vm2 Sandbox Escape vulnerability 9.8 critical No fix published 13 Jul 2023
CVE-2023-32314: vm2 Sandbox Escape vulnerability 9.8 critical 3.9.18 15 May 2023
CVE-2023-30547: vm2 Sandbox Escape vulnerability 9.8 critical 3.9.17 20 Apr 2023
CVE-2023-29199: vm2 Sandbox Escape vulnerability 9.8 critical 3.9.16 12 Apr 2023
CVE-2023-29017: vm2 vulnerable to sandbox escape 9.8 critical 3.9.15 07 Apr 2023
CVE-2022-25893: vm2 vulnerable to Arbitrary Code Execution 9.8 critical 3.9.10 21 Dec 2022
CVE-2021-23555: Sandbox bypass in vm2 9.8 critical 3.9.6 12 Feb 2022
CVE-2021-23449: Prototype Pollution in vm2 9.8 critical 3.9.4 19 Oct 2021
CVE-2026-44007: vm2 NodeVM Nesting Bypass Leading to Arbitrary OS Command Execution 9.1 critical 3.11.1 07 May 2026
CVE-2026-92934: vm2 Package Vulnerability Leading to Host RCE via AggregateError Bypass 9.0 critical 3.11.8 05 Oct 2026
Critical Authorization Bypass in vm2 Package Leading to Sandbox Escape 9.0 critical 3.12.2 27 Sep 2026
Critical Remote Code Execution Vulnerability in vm2 Package 9.0 critical No fix published 17 Sep 2026
CVE-2026-47683: vm2 Buffer Allocation Limit Bypass Vulnerability 8.7 high 3.11.6 17 Aug 2026
CVE-2026-47135: vm2 Package Sandbox Escape via Unblocked Cross-Realm Symbol Keys 8.7 high 3.11.4 29 May 2026
CVE-2026-100722: vm2 Package Host Promise Rejection Can Terminate Host Process 8.6 high 3.12.2 05 Oct 2026
CVE-2026-92950: vm2 CLI Lacks Sandbox Isolation, Allowing Host Realm Access 8.6 high 3.11.7 01 Oct 2026
Critical Sandbox Escape Vulnerability in vm2 Package 8.6 critical No fix published 17 Sep 2026
CVE-2026-47139: vm2 Package Network Builtin Exclusions Bypass Vulnerability 8.6 high 3.11.4 29 May 2026
CVE-2026-47209: vm2 Package Vulnerability Allows Host Object Property Injection via Prototype Chain 8.6 high 3.11.4 29 May 2026
CVE-2026-44001: vm2 Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS) 8.6 high 3.11.0 07 May 2026
CVE-2026-92958: vm2 Denylist Bypass Vulnerability Allowing Host Filesystem Writes 8.5 high 3.11.7 01 Oct 2026
High Severity Denylist Bypass Vulnerability in vm2 Package 8.5 high No fix published 17 Sep 2026
CVE-2019-10761: vm2 Sandbox Escape Vulnerability 8.3 high 3.6.11 14 Jul 2022
CVE-2026-92942: vm2 Timeout Option Bypass Leading to Unbounded Host Event-Loop Block 7.5 high 3.11.7 05 Oct 2026
Memory Exposure Vulnerability in vm2: NodeVM zlib Buffers 7.5 medium 3.12.2 27 Sep 2026
Unbounded Host Event-Loop Block in vm2: Timeout Option Bypass Vulnerability 7.5 high No fix published 17 Sep 2026
Memory Exhaustion DoS in vm2: Bypass of bufferAllocLimit 7.5 high 3.11.6 17 Aug 2026
CVE-2026-44004: vm2 Package Memory Exhaustion Vulnerability via Buffer.alloc 7.5 high 3.11.0 07 May 2026
CVE-2026-92959: vm2 Package Asynchronous Code Execution Bypass Vulnerability 7.1 high 3.11.8 05 Oct 2026
Bypass of Async Restrictions in vm2 Package: Critical Vulnerability Overview 7.1 high No fix published 17 Sep 2026
Critical Vulnerability in vm2: Host Promise Rejection Can Terminate Process 6.8 high 3.12.2 27 Sep 2026
CVE-2026-44000: vm2 Host Promise Resolution Vulnerability Allows Object Identity Leakage 6.5 medium 3.11.0 07 May 2026
CVE-2026-92933: vm2 Package Vulnerability Allows Host Call Stack Leakage 5.8 medium 3.11.8 05 Oct 2026
Host Call Stack Exposure in vm2: Bypass of Redaction Mechanism 5.8 medium No fix published 17 Sep 2026
CVE-2026-44002: vm2 Vulnerable to Host File Path Disclosure via Stack Trace Information Leak 5.8 medium 3.11.0 07 May 2026
Access Control Flaw in vm2: Exposure of Internal State Variable 5.3 medium 3.11.2 08 May 2026
CVE-2026-44003: vm2 Package Transformer Fast-Path Bypass Exposes Internal State Variable 5.3 medium 3.11.0 07 May 2026
CVE-2023-32313: vm2 vulnerable to Inspect Manipulation 5.3 medium 3.9.18 17 May 2023
CVE-2026-47141: vm2 NodeVM Observability Builtins Leak Host Process and HTTP Request Data 4.6 medium 3.11.4 29 May 2026
CVE-2026-92945: vm2 External Module Allowlist Bypass Vulnerability 4.2 medium 3.11.7 01 Oct 2026
Module Allowlist Bypass Vulnerability in vm2: External Module Prefix Test Flaw 4.2 low No fix published 17 Sep 2026
Defense Invariant Violation in vm2: Potential Side Channel Exposure 2.1 low 3.11.4 29 May 2026

Looking for another version, or everything Vulert holds for vm2?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About vm2 3.6.10

Is vm2 3.6.10 vulnerable?

Yes. 77 vulnerabilities in the Vulert database cover vm2 3.6.10: 47 critical, 17 high, 11 medium and 2 low. The upgrade Vulert recommends is 3.12.2, and each entry above names the fixed version to move to.

Which version of vm2 should I use instead of 3.6.10?

3.12.2 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 3.6.10 the latest release of vm2?

No. 3.6.10 was published 28 Jan 2019, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor vm2 for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the vm2 version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.