Executive brief
vm2 is a popular sandbox library for Node.js used to run untrusted code safely. A vulnerability in how it handles asynchronous tasks allows an attacker to bypass security restrictions and crash the entire host application. This results in a complete denial of service, where a single malicious request can shut down the server for all users, potentially leading to a continuous outage if the attacker repeats the exploit after restarts.
Technical details
A sandbox escape in vm2 v3.10.5 and earlier allows untrusted code to trigger a host-process crash. The vulnerability exists because the Promise constructor executor is not wrapped in a try-catch block, allowing errors to propagate as unhandled rejections to the host realm. Specifically, by setting an Error object's name to a Symbol and accessing its stack, V8's internal formatting triggers a TypeError that escapes the sandbox. This bypasses previous fixes that only sanitized .then() and .catch() callbacks. An attacker can exploit this remotely if the application executes user-provided code, leading to a persistent Denial of Service (DoS) even if process managers like PM2 or Kubernetes attempt to restart the container.
Affected products
- patriksimek vm2 <= 3.10.5
Timeline
- 2026-05-01: advisory: GitHub Security Advisory published by maintainer
- 2026-05-13: disclosed: CVE-2026-44001 published to NVD
- 2026-05-13: patched: Fixed in version 3.11.0