CVE-2026-92944
vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector
Name or handle: [YMsora] - Report date: 2026-08-14
- No known exploitation
- Severity
- Critical, CVSS 9.8 (v3.1)
- EPSS
- 0.84% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- vm2 (npm) >= 3.10.2, <= 3.11.6, fixed in 3.11.7 · GHSA-27g9-p43v-cw3v