CVE-2026-92954
vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process
vm2 current head (v3.11.5, commit 7a1f5100b96f48d34e0fe104ab37c0acc5944f92) can still be used to terminate the host Node.js process when sandbox code calls a host-realm function that returns a rejected host Promise and then ignores the returned value.
- No known exploitation
- Severity
- Critical, CVSS 9.2 (v4.0)
- EPSS
- 0.49% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- vm2 (npm) >= 3.10.0, <= 3.11.7, fixed in 3.11.8 · GHSA-gjq8-xm47-88rc