npm (Node.js)

vm2 Security Analysis

vm2 has 21 known security vulnerabilities in npm (Node.js). Upgrade to version 3.11.6 or later to resolve all known issues. Data sourced from OSV, enriched with EPSS exploit probability and CISA KEV.

21 Vulnerabilities

Low Immediate Risk

No actively exploited vulnerabilities detected. Monitor and update in your next maintenance window.

Recommended safe version: 3.11.6

Upgrading to 3.11.6 or later resolves all 21 known vulnerabilities in vm2. Run: npm install vm2@3.11.6

Is vm2 in your project?

Check if you're affected and upgrade to 3.11.6 to stay secure.

Start Free Scan Get Alerted When New CVEs Drop

Total

Critical

High

Medium

Low

Vulnerabilities

21 unique vulnerabilities — sorted by exploitation risk (KEV → EPSS → CVSS). Click a CVE/GHSA ID for full details.

CVE / GHSA	Severity	CVSS	EPSS	Summary	Affected	Fixed In
CVE-2026-47140 NodeVM builtin denylist bypass via process and inspector/promises allows host code execution	CRITICAL	10.0	—	NodeVM builtin denylist bypass via process and inspector/promises allows host code execution	All versions	3.11.4
CVE-2026-47137 vm2 has a CVE-2023-37903 patch bypass: nesting:true without explicit require still allows full RCE	CRITICAL	10.0	—	vm2 has a CVE-2023-37903 patch bypass: nesting:true without explicit require still allows full RCE	All versions	3.11.4
CVE-2026-47208 vm2 is Vulnerable to Sandbox Breakout Through Promise Species	CRITICAL	10.0	—	vm2 is Vulnerable to Sandbox Breakout Through Promise Species	All versions	3.11.4
CVE-2026-47686 VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE	CRITICAL	9.9	—	VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE	All versions	3.11.6
CVE-2026-44005 vm2: Mutable Proxies for Host Intrinsic Prototypes Allows Sandbox Escape	CRITICAL	10.0	—	vm2: Mutable Proxies for Host Intrinsic Prototypes Allows Sandbox Escape	All versions	3.11.0
CVE-2026-43997 vm2 Access to Host Object Enables Sandbox Escape	CRITICAL	10.0	—	vm2 Access to Host Object Enables Sandbox Escape	All versions	3.11.0
CVE-2026-47698 vm2: Sandbox Breakout Using Dangerous Host Proto Mutators	CRITICAL	9.8	—	vm2: Sandbox Breakout Using Dangerous Host Proto Mutators	All versions	3.11.6
CVE-2026-43999 vm2 has a NodeVM builtin allowlist bypass via `module` builtin's `Module._load` that allows sandbox escape	CRITICAL	9.9	—	vm2 has a NodeVM builtin allowlist bypass via `module` builtin's `Module._load` that allows sandbox escape	3.10.5	3.11.0
CVE-2026-47210 vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass	CRITICAL	9.8	—	vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass	All versions	3.11.4
CVE-2026-45411 vm2 Has a Sandbox Breakout Using Async Generator	CRITICAL	9.8	—	vm2 Has a Sandbox Breakout Using Async Generator	All versions	3.11.3
CVE-2026-44009 vm2 has Sandbox Breakout Through Null Proto Exception	CRITICAL	9.8	—	vm2 has Sandbox Breakout Through Null Proto Exception	All versions	3.11.2
CVE-2026-44008 vm2 has sandbox breakout via `neutralizeArraySpeciesBatch`	CRITICAL	9.8	—	vm2 has sandbox breakout via `neutralizeArraySpeciesBatch`	All versions	3.11.2
CVE-2026-26332 VM2 Has a Sandbox Escape Issue via SuppressedError	CRITICAL	9.8	—	VM2 Has a Sandbox Escape Issue via SuppressedError	All versions	3.11.0
CVE-2026-24781 VM2 Has Sandbox Breakout Through Inspect Function	CRITICAL	9.8	—	VM2 Has Sandbox Breakout Through Inspect Function	All versions	3.11.0
CVE-2026-24120 VM2 Has Sandbox Breakout Through Promise Species	CRITICAL	9.8	—	VM2 Has Sandbox Breakout Through Promise Species	All versions	3.10.5
CVE-2026-24118 VM2 Sandbox Breakout Through __lookupGetter__	CRITICAL	9.8	—	VM2 Sandbox Breakout Through __lookupGetter__	All versions	3.11.0
CVE-2026-44007 vm2 NodeVM `nesting: true` bypasses `require: false` allowing sandbox escape and arbitrary OS command execution	CRITICAL	9.1	—	vm2 NodeVM `nesting: true` bypasses `require: false` allowing sandbox escape and arbitrary OS command execution	All versions	3.11.1
CVE-2026-47135 vm2 has a sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks	HIGH	8.7	—	vm2 has a sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks	All versions	3.11.4
CVE-2026-47139 NodeVM network builtin exclusions bypass via internal _http_client and _http_server	HIGH	8.6	—	NodeVM network builtin exclusions bypass via internal _http_client and _http_server	All versions	3.11.4
CVE-2026-47209 vm2's Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain	HIGH	8.6	—	vm2's Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain	All versions	3.11.4
CVE-2026-44001 vm2 has a Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)	HIGH	8.6	—	vm2 has a Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)	All versions	3.11.0

About This Data

Vulnerability data for vm2 is sourced from the Open Source Vulnerability (OSV) database, aggregating reports from GitHub Advisory Database, NIST NVD, and ecosystem-specific sources.

CVSS (Common Vulnerability Scoring System) scores reflect exploitability and impact. EPSS (Exploit Prediction Scoring System) scores indicate the probability of exploitation within the next 30 days. Vulnerabilities marked with are listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Related npm (Node.js) Packages

Other packages in this ecosystem, ranked by shared vulnerabilities where available.

openclaw n8n flowise parse-server flowise-components @budibase/server fuxa-server tar

Check Your Dependencies

Scan your project to check if you're using a vulnerable version of vm2.

Start Free Scan Create Free Account

Data from OSV DatabaseUpdated daily200K+ vulnerabilities indexed