8.6
High
CVE-2026-44001 vm2 is an open source vm/sandbox for Node.js
Description
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox escape vulnerability in vm2 v3.10.5 allows any sandboxed code to crash the host Node.js process via a single Promise constructor that triggers an unhandled rejection propagating to the host. The fix for CVE-2026-22709 (v3.10.2) only sanitized the onRejected callback in .then() and .catch() overrides and did not address the executor-to-unhandledRejection path. This vulnerability is fixed in 3.11.0.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| vm2 3.11 | earliest → < 3.11.0 | 3.11.0 |
| Self-service automation portal 2 | Versions not published | |
| Red Hat Developer Hub | Versions not published | |
| Red Hat Ansible Automation Platform 2.1 1785854226 | earliest → < 1785854226 | 1785854226 |
References
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of vm2
The 77 CVEs of vm2 →
CVE-2026-100723
vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength…
6.9
Medium
CVE-2026-100722
vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap
8.9
High
CVE-2026-100721
vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver
9.5
Critical
CVE-2026-93606
vm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in `VM` and `NodeVM`
10.0
Critical