Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.2
CVE-2026-92954: vm2 sandbox can let rejected Promise crash host
CVE-2026-92954 · published 23 days ago
Summary
When using vm2 version 3.10.0 through 3.11.7, code run inside the sandbox can call a host function that returns a rejected Promise and ignore the result. This leaves the Promise unhandled, causing Node.js to shut down the entire application. Upgrade vm2 to version 3.11.8 or later to prevent this behavior.
What to do
- Update vm2 to version 3.11.8.
- Update patriksimek vm2 to version 3.11.8 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | patriksimek | vm2 | < 3.11.8 |
| npm | – | vm2 |
>= 3.10.0, <= 3.11.7 >= 3.10.0, < 3.11.8 Fix: upgrade to 3.11.8
|
Original advisory text
vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process
vm2 is a sandbox library for running untrusted JavaScript in Node.js. In versions >= 3.10.0 and <= 3.11.7, Promises returned from the host realm into the sandbox are not marked as handled at the bridge boundary; only Promises created inside the sandbox are wrapped with a rejection-swallowing handler (lib/setup-sandbox.js), and the bridge only installs host-side rejection sanitizers when sandbox code calls .then/.catch/.finally. As a result, code running in the sandbox can invoke a host function that returns a rejected Promise (for example events.once() exposed via the NodeVM events builtin, or any embedder-provided Promise-returning API) and simply ignore the return value, leaving the host Promise unhandled so that Node.js's default unhandled-rejection behavior terminates the host process. This is an incomplete fix of GHSA-hw58-p9xv-2mjh. The issue is fixed in version 3.11.8.
References
- https://github.com/patriksimek/vm2/security/advisories/GHSA-gjq8-xm47-88rc
- https://www.vulncheck.com/advisories/vm2-3.10.0-through-3.11.5-denial-of-service...
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92954... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-92954 Vendor Advisory
- https://github.com/patriksimek/vm2/commit/5bb37f8b3f0498675a71cfa4df2b408d8ef7d4... URL
- https://github.com/patriksimek/vm2/releases/tag/v3.11.8 URL
- https://github.com/advisories/GHSA-gjq8-xm47-88rc
- https://github.com/patriksimek/vm2 Product
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
9.2
Critical
Type
CWE-248Uncaught Exception
CWE-703Improper Check or Handling of Exceptional Conditions
Timeline
Published17 Sep 2026
Updated9 Oct 2026
First seen17 Sep 2026
Sources
CVE-2026-92954 · NVD
CVE-2026-92954 · MITRE
CVE-2026-92954 · OSV
GHSA-gjq8-xm47-88rc · GHSA
GHSA-gjq8-xm47-88rc · OSV
Track software like this
Free during beta