CVE-2026-92942: vm2 timeout bypass via FinalizationRegistry callback

CVE-2026-92942 · Severity: high · CVSS 7.5 · Published 2026-09-17

vm2 is a sandboxing library that executes untrusted JavaScript in an isolated context with configurable execution time limits. This vulnerability allows sandboxed code to run arbitrary code after the timeout expires and outside vm2's control, blocking the entire host application's event loop indefinitely. An attacker can abuse garbage-collection callbacks to execute a busy loop that freezes all operations on the server, causing a denial of service.

Technologies: vm2 (npm). Vendors: npm.

Quick answers

Is CVE-2026-92942 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-92942 being exploited in the wild.
How severe is CVE-2026-92942?
High severity, with a CVSS score of 7.5, published 17 September 2026.
Which products and versions are affected?
vm2 (npm) <= 3.11.6, SEMVER:introduced=0,fixed=3.11.7.
Is there a fix for CVE-2026-92942?
Yes. vm2 (npm): upgrade to 3.11.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-92942 attacked?
It is attacked over the network.
Am I affected by CVE-2026-92942?
Check whether you run vm2 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • vm2 (npm): upgrade to 3.11.7 or later
    npm install vm2@3.11.7

Technical details

vm2 implements execution timeouts by wrapping only the synchronous VM#run() call with doWithTimeout(), which bounds the primary script execution. However, FinalizationRegistry and WeakRef—exposed unmodified in the sandbox global scope—allow sandboxed code to register callbacks scheduled by the V8 garbage collector outside vm2's timeout accounting. An attacker registers a FinalizationRegistry cleanup callback, drops the object reference to make it GC-eligible, and then vm.run() returns normally within the configured timeout. When the garbage collector later invokes the cleanup callback (forcibly triggerable via --expose-gc or under memory pressure), the sandboxed code runs unbounded and unmetered, blocking the host event loop indefinitely. The vulnerability is a denial-of-service condition that breaks the timeout promise on which vm2's security model relies. Patched in version 3.11.7 by removing or hardening FinalizationRegistry and WeakRef from the sandbox global scope.

Affected products

  • vm2 vm2 <= 3.11.6

Identifiers

  • CVE-2026-92942
  • GHSA-r4fx-v8hh-22mv

Timeline

  • 2026-08-24: disclosed
  • 2026-09-17: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.