Denial of Service Vulnerability in vm2 Sandbox Library for Node.js

CVE-2026-92954

What is CVE-2026-92954?

The vm2 sandbox library, used to run untrusted JavaScript in Node.js, contains a vulnerability that allows for a denial of service. In versions 3.10.0 through 3.11.7, Promises returned from the host realm into the sandbox are not properly handled, leading to potential unhandled promise rejections. This occurs when a host function, like events.once() or any Promise-returning API, is invoked from the sandbox and returns a rejected Promise. If this rejection is ignored, Node.js can terminate the host process due to its default unhandled-rejection behavior. The issue has been partially addressed in version 3.11.8.

References