# Vm2 vulnerabilities Source: https://junglewise.ai/threats/technologies/x-vm2 Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/x-vm2.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 14 vulnerabilities in Vm2: 0 in the last 7 days and 14 in the last 90 days, 7 of them critical and 0 exploited in the wild. The most recent, vm2 NodeVM zlib buffer pool information disclosure, was published on 27 September 2026. Nothing in the last four weeks, down from 14 vulnerabilities in the four before. 0 critical against 7. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 14 - All time: 14 (7 critical, 0 exploited in the wild) ## About Vm2 JavaScript runtime library that executes code in a sandboxed environment. ## Latest Vm2 vulnerabilities - [vm2 NodeVM zlib buffer pool information disclosure](https://junglewise.ai/threats/duplicate-advisory-vm2-nodevm-zlib-buffers-expose-pooled-host-memory-6007c734) (high, CVSS 7.5, published 27 Sep 2026) - [vm2 host Promise rejection denial of service in construct trap](https://junglewise.ai/threats/duplicate-advisory-vm2-host-promise-rejection-from-an-exposed-f7aba6ba) (medium, CVSS 6.8, published 27 Sep 2026) - [CVE-2026-100722: vm2 unhandled Promise rejection in construct trap](https://junglewise.ai/threats/cve-2026-100722-vm2-before-3-12-2-does-not-apply-host-side-promise-rejection) (high, CVSS 8.6, published 27 Sep 2026) - [vm2 TypedArray and ArrayBuffer prototype mutation sandbox escape](https://junglewise.ai/threats/duplicate-advisory-default-vm-can-mutate-host-typedarray-and-5ed620b3) (critical, CVSS 10, published 17 Sep 2026) - [vm2 sandbox escape via incomplete symbol filtering](https://junglewise.ai/threats/duplicate-advisory-incomplete-nodejs-symbol-filtering-lets-sandbox-af639517) (medium, CVSS 6.8, published 17 Sep 2026) - [vm2 allowAsync bypass through Promise thenable assimilation](https://junglewise.ai/threats/duplicate-advisory-allowasync-false-can-be-bypassed-through-promise-9a81cfad) (high, CVSS 7.1, published 17 Sep 2026) - [vm2 allowlist bypass via substring matching in module resolver](https://junglewise.ai/threats/duplicate-advisory-vm2-custom-module-resolver-can-bypass-the-external-16d7b5dc) (critical, CVSS 9.9, published 17 Sep 2026) - [vm2 sandbox bypass via accessor descriptor in freeze/readonly](https://junglewise.ai/threats/duplicate-advisory-vm2-vm-freeze-vm-readonly-bypass-via-accessor-c65e1fdb) (medium, CVSS 4, published 17 Sep 2026) - [vm2 sandbox escape via crypto.setEngine native code loading](https://junglewise.ai/threats/duplicate-advisory-vm2-crypto-builtin-loads-attacker-native-code-fea6866a) (critical, CVSS 9.9, published 17 Sep 2026) - [vm2 sandbox escape via node:sqlite module exposure](https://junglewise.ai/threats/duplicate-advisory-vm2-3-11-6-allows-a-sandboxed-plugin-to-execute-150de57a) (critical, CVSS 9.9, published 17 Sep 2026) - [vm2 timeout option bypass via FinalizationRegistry cleanup callback](https://junglewise.ai/threats/duplicate-advisory-vm2-timeout-option-bypass-via-finalizationregistry-19556987) (high, CVSS 7.5, published 17 Sep 2026) - [vm2 sandbox escape to RCE via AggregateError Error.cause sanitization bypass](https://junglewise.ai/threats/duplicate-advisory-vm2-sandbox-escape-to-host-rce-via-revisited-host-b28aa992) (critical, CVSS 9, published 17 Sep 2026) - [vm2 NodeVM nesting guard bypass permits host RCE](https://junglewise.ai/threats/duplicate-advisory-nodevm-nesting-guard-accepts-array-shaped-require-e4adbb8b) (critical, CVSS 9, published 17 Sep 2026) - [vm2 sandbox escape on Node.js 26 through stale PromiseThenLookupChain](https://junglewise.ai/threats/duplicate-advisory-vm2-sandbox-escape-on-node-js-26-through-a-stale-0ecbfabc) (critical, CVSS 9.8, published 17 Sep 2026) ## Most severe Vm2 vulnerabilities - [vm2 TypedArray and ArrayBuffer prototype mutation sandbox escape](https://junglewise.ai/threats/duplicate-advisory-default-vm-can-mutate-host-typedarray-and-5ed620b3) (critical, CVSS 10, published 17 Sep 2026) - [vm2 allowlist bypass via substring matching in module resolver](https://junglewise.ai/threats/duplicate-advisory-vm2-custom-module-resolver-can-bypass-the-external-16d7b5dc) (critical, CVSS 9.9, published 17 Sep 2026) - [vm2 sandbox escape via node:sqlite module exposure](https://junglewise.ai/threats/duplicate-advisory-vm2-3-11-6-allows-a-sandboxed-plugin-to-execute-150de57a) (critical, CVSS 9.9, published 17 Sep 2026) - [vm2 sandbox escape via crypto.setEngine native code loading](https://junglewise.ai/threats/duplicate-advisory-vm2-crypto-builtin-loads-attacker-native-code-fea6866a) (critical, CVSS 9.9, published 17 Sep 2026) - [vm2 sandbox escape on Node.js 26 through stale PromiseThenLookupChain](https://junglewise.ai/threats/duplicate-advisory-vm2-sandbox-escape-on-node-js-26-through-a-stale-0ecbfabc) (critical, CVSS 9.8, published 17 Sep 2026) - [vm2 sandbox escape to RCE via AggregateError Error.cause sanitization bypass](https://junglewise.ai/threats/duplicate-advisory-vm2-sandbox-escape-to-host-rce-via-revisited-host-b28aa992) (critical, CVSS 9, published 17 Sep 2026) - [vm2 NodeVM nesting guard bypass permits host RCE](https://junglewise.ai/threats/duplicate-advisory-nodevm-nesting-guard-accepts-array-shaped-require-e4adbb8b) (critical, CVSS 9, published 17 Sep 2026) - [CVE-2026-100722: vm2 unhandled Promise rejection in construct trap](https://junglewise.ai/threats/cve-2026-100722-vm2-before-3-12-2-does-not-apply-host-side-promise-rejection) (high, CVSS 8.6, published 27 Sep 2026) - [vm2 NodeVM zlib buffer pool information disclosure](https://junglewise.ai/threats/duplicate-advisory-vm2-nodevm-zlib-buffers-expose-pooled-host-memory-6007c734) (high, CVSS 7.5, published 27 Sep 2026) - [vm2 timeout option bypass via FinalizationRegistry cleanup callback](https://junglewise.ai/threats/duplicate-advisory-vm2-timeout-option-bypass-via-finalizationregistry-19556987) (high, CVSS 7.5, published 17 Sep 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 14 vulnerabilities in the four before. 0 critical against 7. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 11 | 7 | 0 | | 21 Sep 2026 | 3 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Vm2 vulnerabilities", https://junglewise.ai/threats/technologies/x-vm2, 9 November 2026.