CVE-2026-92954 Details
Description
vm2 is a sandbox library for running untrusted JavaScript in Node.js. In versions >= 3.10.0 and <= 3.11.7, Promises returned from the host realm into the sandbox are not marked as handled at the bridge boundary; only Promises created inside the sandbox are wrapped with a rejection-swallowing handler (lib/setup-sandbox.js), and the bridge only installs host-side rejection sanitizers when sandbox code calls .then/.catch/.finally. As a result, code running in the sandbox can invoke a host function that returns a rejected Promise (for example events.once() exposed via the NodeVM events builtin, or any embedder-provided Promise-returning API) and simply ignore the return value, leaving the host Promise unhandled so that Node.js's default unhandled-rejection behavior terminates the host process. This is an incomplete fix of GHSA-hw58-p9xv-2mjh. The issue is fixed in version 3.11.8.
A denial-of-service vulnerability has been identified in the vm2 sandbox library, specifically in versions 3.10.0 through 3.11.7. The issue arises because Promises returned from the host realm into the sandbox are not properly marked as handled at the bridge boundary. While Promises created within the sandbox are wrapped with a rejection-swallowing handler, host-returned Promises are left unhandled unless the sandbox code explicitly calls .then, .catch, or .finally. This oversight allows sandbox code to invoke host functions that return rejected Promises, such as those from the NodeVM events builtin, and simply ignore them. As a result, the unhandled Promise rejection triggers Node.js's default behavior, terminating the host process. This vulnerability represents an incomplete fix of a previous issue documented in GHSA-hw58-p9xv-2mjh.
Users can upgrade to vm2 version 3.11.8, where this vulnerability has been fixed. Additionally, applications can implement a process-level 'unhandledRejection' handler to swallow rejections originating from vm2, as recommended in the vm2 README.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/patriksimek/vm2/security/advisories/GHSA-gjq8-xm47-88rc | CISA-ADP | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://github.com/patriksimek/vm2/security/advisories/GHSA-gjq8-xm47-88rc | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/vm2-3.10.0-through-3.11.5-denial-of-service-via-host-promise | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-248 | Uncaught Exception | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vm2 | >= 3.10.0, <= 3.11.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | [email protected] |