CVE-2026-45102: OneUptime: RCE due to Node.js' vm module escape via error objects and infinite recursion
Published May 27, 2026
·Updated
OneUptime is an open-source monitoring and observability platform. Prior to 10.0.98, OneUptime uses the Node.js' vm module as an isolation primitive. This API was not designed for that and can be escaped via error objects and infinite recursion. This vulnerability is fixed in 10.0.98.
Affected Software
1 affected component
OneUptime OneUptime<10.0.98
Event History
May 27, 2026
CVE Published
via MITRE·06:50 PM
Data Sourced
via MITRE·06:50 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-45102?
The severity of CVE-2026-45102 is critical, rated at 9.9.
2
How do I fix CVE-2026-45102?
To fix CVE-2026-45102, upgrade OneUptime to version 10.0.98 or later.
3
What is the impact of CVE-2026-45102?
CVE-2026-45102 can lead to remote code execution due to the exploitation of the Node.js vm module.
4
Which software is affected by CVE-2026-45102?
OneUptime versions prior to 10.0.98 are affected by CVE-2026-45102.
5
When was CVE-2026-45102 published?
CVE-2026-45102 was published on May 27, 2026.