REDHAT-BUG-2477208: High severity vm2 vulnerability
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox escape vulnerability in vm2 v3.10.5 allows any sandboxed code to crash the host Node.js process via a single Promise constructor that triggers an unhandled rejection propagating to the host. The fix for CVE-2026-22709 (v3.10.2) only sanitized the onRejected callback in .then() and .catch() overrides and did not address the executor-to-unhandledRejection path. This vulnerability is fixed in 3.11.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vm2to a version that resolves this vulnerability.Fixed in 3.11.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.11.0Patch CVE-2026-22709
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using vm2 versions before 3.11.0 are affected, including v3.10.5. The issue applies where untrusted or sandboxed code can be executed through vm2.
What does an attacker need to exploit this issue?
An attacker needs the ability to run code inside the vm2 sandbox. A single Promise constructor can trigger an unhandled rejection that propagates to the host Node.js process.
What is the impact of successful exploitation?
Sandboxed code can crash the host Node.js process, creating a denial-of-service condition.
Does the earlier CVE-2026-22709 fix prevent this issue?
No. The v3.10.2 fix sanitized the onRejected callback in overridden .then() and .catch() methods, but did not address the executor-to-unhandledRejection path.
What version fixes the vulnerability?
Upgrade vm2 to version 3.11.0, which fixes this vulnerability.