Technology
Vm2 vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 14 vulnerabilities in Vm2: 0 in the last 7 days and 14 in the last 90 days, 7 of them critical and 0 exploited in the wild. The most recent, vm2 NodeVM zlib buffer pool information disclosure, was published on 27 September 2026. Nothing in the last four weeks, down from 14 vulnerabilities in the four before. 0 critical against 7.
- Last 7 days
- 0
- Last 90 days
- 14
- Critical, all time
- 7
- Exploited in the wild
- 0
About Vm2
JavaScript runtime library that executes code in a sandboxed environment.
Latest Vm2 vulnerabilities
- vm2 NodeVM zlib buffer pool information disclosurehighCVSS 7.5
- vm2 host Promise rejection denial of service in construct trapmediumCVSS 6.8
- CVE-2026-100722: vm2 unhandled Promise rejection in construct traphighCVSS 8.6EPSS 0.3%
- vm2 TypedArray and ArrayBuffer prototype mutation sandbox escapecriticalCVSS 10
- vm2 sandbox escape via incomplete symbol filteringmediumCVSS 6.8
- vm2 allowAsync bypass through Promise thenable assimilationhighCVSS 7.1
- vm2 allowlist bypass via substring matching in module resolvercriticalCVSS 9.9
- vm2 sandbox bypass via accessor descriptor in freeze/readonlymediumCVSS 4
- vm2 sandbox escape via crypto.setEngine native code loadingcriticalCVSS 9.9
- vm2 sandbox escape via node:sqlite module exposurecriticalCVSS 9.9
- vm2 timeout option bypass via FinalizationRegistry cleanup callbackhighCVSS 7.5
- vm2 sandbox escape to RCE via AggregateError Error.cause sanitization bypasscriticalCVSS 9
- vm2 NodeVM nesting guard bypass permits host RCEcriticalCVSS 9
- vm2 sandbox escape on Node.js 26 through stale PromiseThenLookupChaincriticalCVSS 9.8
Most severe Vm2 vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- vm2 TypedArray and ArrayBuffer prototype mutation sandbox escapecriticalCVSS 10
- vm2 allowlist bypass via substring matching in module resolvercriticalCVSS 9.9
- vm2 sandbox escape via node:sqlite module exposurecriticalCVSS 9.9
- vm2 sandbox escape via crypto.setEngine native code loadingcriticalCVSS 9.9
- vm2 sandbox escape on Node.js 26 through stale PromiseThenLookupChaincriticalCVSS 9.8
- vm2 sandbox escape to RCE via AggregateError Error.cause sanitization bypasscriticalCVSS 9
- vm2 NodeVM nesting guard bypass permits host RCEcriticalCVSS 9
- CVE-2026-100722: vm2 unhandled Promise rejection in construct traphighCVSS 8.6EPSS 0.3%
- vm2 NodeVM zlib buffer pool information disclosurehighCVSS 7.5
- vm2 timeout option bypass via FinalizationRegistry cleanup callbackhighCVSS 7.5
Vulnerabilities per week
Nothing in the last four weeks, down from 14 vulnerabilities in the four before. 0 critical against 7. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 11 | 7 | |
| 21 Sep 2026 | 3 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Vm2 vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/x-vm2)<a href="https://junglewise.ai/threats/technologies/x-vm2"><img src="https://junglewise.ai/threats/technologies/x-vm2/badge.svg" alt="Vm2 vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/x-vm2.json, and this page as text at https://junglewise.ai/threats/technologies/x-vm2.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Vm2 vulnerabilities", https://junglewise.ai/threats/technologies/x-vm2, 9 November 2026.