Executive brief
vm2 is a sandbox library that isolates untrusted JavaScript code running in Node.js. Attackers who execute code within the sandbox can trigger a denial of service by calling host functions that return rejected Promises and ignoring the result, causing the entire host process to terminate. In multi-tenant or service environments, this allows a small malicious script to crash the worker, disrupting service availability.
Technical details
The vulnerability is a Promise rejection handling bypass in vm2's sandbox bridge. When untrusted code calls a host function that returns a rejected Promise (such as events.once() or any embedder-exposed Promise-returning API) and does not attach a .catch() or .then() handler, the host-side Promise remains unhandled. While vm2 wraps sandbox-created Promises with rejection handlers, host Promises are only instrumented when sandbox code explicitly calls .then/.catch/.finally on them. If the Promise is ignored, Node.js's default unhandled-rejection behavior (process termination) occurs, crashing the host. This affects versions 3.10.0 through 3.11.7; the fix in 3.11.8 adds host-side rejection handlers at the bridge boundary for all returned Promises.
Affected products
- patriksimek vm2 3.10.0 through 3.11.7
Timeline
- 2026-08-27: disclosed
- 2026-09-17: advisory
- 2026-09-17: patched: Fixed in version 3.11.8