Timeout Bypass in vm2 Affects Multiple Versions by Patrik Simek

CVE-2026-92942

What is CVE-2026-92942?

The vm2 library prior to version 3.11.7 does not enforce the VM({ timeout }) option effectively for code executed outside the synchronous VM#run() call. Specifically, the timeout is only applied when invoking _runScript(), allowing sandboxed code to exploit the lack of enforcement. This results in the FinalizationRegistry and WeakRef being accessible without restrictions. A sandboxed script can register a cleanup callback on a FinalizationRegistry instance and subsequently remove all strong references to the targeted object. Although vm.run() may return within the specified timeout, the V8 garbage collector may eventually initiate the cleanup callback, which can lead to a busy loop that blocks the host event loop indefinitely. This unwanted behavior creates a potential denial of service vulnerability, exacerbated by conditions such as memory pressure.

References