Is vm2 3.11 vulnerable?
npm · 9 releases from 3.11.0 to 3.11.8 · latest vm2 is 3.12.2 · checked 1 Nov 2026
Yes: 4 known advisories
Yes. vm2 3.11.8, the last 3.11 release, is affected by 4 known security advisories (2 critical, 1 high, 1 medium), including CVE-2026-93605, CVE-2026-100721, CVE-2026-100722. 46 more affect earlier 3.11.x releases. Upgrade to 3.12.2 or later to fix all of them.
npm install vm2@3.12.2Advisories affecting vm2 3.11.8
vm2 contains a sandbox escape vulnerability
- Affected
- <3.12.1
- Fixed in
- 3.12.1
vm2: NodeVM custom resolution bypasses external path boundaries
- Affected
- <3.12.2
- Fixed in
- 3.12.2
vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process
- Affected
- <3.12.2
- Fixed in
- 3.12.2
vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary
- Affected
- <3.12.2
- Fixed in
- 3.12.2
Fixed within 3.11.x, affecting earlier releases
vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM
- Affected
- <3.11.8
- Fixed in
- 3.11.8
vm2: Sandbox Escape (NodeVM)
- Affected
- <3.11.8
- Fixed in
- 3.11.8
vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process
- Affected
- >=3.10.0 <3.11.8
- Fixed in
- 3.11.8
vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix
- Affected
- >=3.11.0 <3.11.8
- Fixed in
- 3.11.8
vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit
- Affected
- <3.11.8
- Fixed in
- 3.11.8
vm2: util.getCallSites() bypasses GHSA-v27g-jcqj-v8rw host-frame redaction, leaks host call stack
- Affected
- <3.11.8
- Fixed in
- 3.11.8
vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting
- Affected
- >=3.11.0 <3.11.7
- Fixed in
- 3.11.7
vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)
- Affected
- <3.11.7
- Fixed in
- 3.11.7
vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE
- Affected
- <3.11.7
- Fixed in
- 3.11.7
vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool
- Affected
- <3.11.7
- Fixed in
- 3.11.7
vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass
- Affected
- >=3.10.1 <3.11.7
- Fixed in
- 3.11.7
vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks
- Affected
- >=3.11.4 <3.11.7
- Fixed in
- 3.11.7
vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape
- Affected
- >=3.9.6 <3.11.7
- Fixed in
- 3.11.7
vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts
- Affected
- <3.11.7
- Fixed in
- 3.11.7
vm2 exposes host HTTPS credentials and TLS traffic through globalAgent
- Affected
- >=3.11.3 <3.11.7
- Fixed in
- 3.11.7
vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package
- Affected
- <3.11.7
- Fixed in
- 3.11.7
vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes
- Affected
- <3.11.7
- Fixed in
- 3.11.7
vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process
- Affected
- <3.11.7
- Fixed in
- 3.11.7
vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor
- Affected
- >=3.9.6 <3.11.7
- Fixed in
- 3.11.7
vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE
- Affected
- >=3.11.4 <3.11.7
- Fixed in
- 3.11.7
vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection
- Affected
- >=3.11.6 <3.11.7
- Fixed in
- 3.11.7
vm2 allows a sandboxed plugin to execute native code through `node:sqlite`
- Affected
- >=3.11.3 <3.11.7
- Fixed in
- 3.11.7
vm2 crypto builtin loads attacker native code through setEngine
- Affected
- >=3.11.3 <3.11.7
- Fixed in
- 3.11.7
vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector
- Affected
- >=3.10.2 <3.11.7
- Fixed in
- 3.11.7
vm2 NodeVM can replace the host process TLS trust store
- Affected
- >=3.11.3 <3.11.7
- Fixed in
- 3.11.7
vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted
- Affected
- <3.11.7
- Fixed in
- 3.11.7
vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass
- Affected
- <3.11.6
- Fixed in
- 3.11.6
vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)
- Affected
- <3.11.6
- Fixed in
- 3.11.6
vm2: Sandbox Breakout Using Dangerous Host Proto Mutators
- Affected
- <3.11.6
- Fixed in
- 3.11.6
VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE
- Affected
- <3.11.6
- Fixed in
- 3.11.6
vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike
- Affected
- <3.11.6
- Fixed in
- 3.11.6
NodeVM observability builtins leak host process and HTTP request data
- Affected
- <3.11.4
- Fixed in
- 3.11.4
NodeVM network builtin exclusions bypass via internal _http_client and _http_server
- Affected
- <3.11.4
- Fixed in
- 3.11.4
NodeVM builtin denylist bypass via process and inspector/promises allows host code execution
- Affected
- <3.11.4
- Fixed in
- 3.11.4
vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass
- Affected
- <3.11.4
- Fixed in
- 3.11.4
vm2 has a CVE-2023-37903 patch bypass: nesting:true without explicit require still allows full RCE
- Affected
- <3.11.4
- Fixed in
- 3.11.4
vm2's Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain
- Affected
- <3.11.4
- Fixed in
- 3.11.4
vm2 has a sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks
- Affected
- <3.11.4
- Fixed in
- 3.11.4
vm2 is Vulnerable to Sandbox Breakout Through Promise Species
- Affected
- <3.11.4
- Fixed in
- 3.11.4
vm2 setup-sandbox.js violates Defense Invariant #11 in stack-trace formatter
- Affected
- <3.11.4
- Fixed in
- 3.11.4
vm2 has a Sandbox Escape issue
- Affected
- <3.11.4
- Fixed in
- 3.11.4
vm2 Has a Sandbox Breakout Using Async Generator
- Affected
- <3.11.3
- Fixed in
- 3.11.3
vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`
- Affected
- <3.11.2
- Fixed in
- 3.11.2
vm2 has Sandbox Breakout Through Null Proto Exception
- Affected
- <3.11.2
- Fixed in
- 3.11.2
vm2 has sandbox breakout via `neutralizeArraySpeciesBatch`
- Affected
- <3.11.2
- Fixed in
- 3.11.2
vm2 NodeVM `nesting: true` bypasses `require: false` allowing sandbox escape and arbitrary OS command execution
- Affected
- <3.11.1
- Fixed in
- 3.11.1
Which of your client projects are still on vm2 3.11?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact vm2 version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other vm2 versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.