VM
Product
vm2
69
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 42High 16Medium 10Low 1
Watch
Add vm2 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-43998 | 8.5 | May 13 | vm2: NodeVM require.root bypass via symlink traversal allows sandbox escape Affected: 3.10.5 |
| CVE-2026-100723 | 7.5 | Sep 27 | vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool Affected: before 3.12.2 |
| CVE-2026-92961 | 7.5 | Sep 17 | vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit Bypass Affected: before 3.11.6 |
| CVE-2026-92942 | 7.5 | Sep 17 | vm2 before 3.11.7 Timeout Bypass via FinalizationRegistry Affected: before 3.11.7 |
| CVE-2026-44004 | 7.5 | May 13 | vm2: Host Process OOM DoS via Buffer.alloc (Timeout Bypass) Affected: < 3.11.0 |
| CVE-2026-93604 | 7.2 | Sep 18 | vm2 3.11.8 Sandbox Escape via crypto.setFips Affected: before 3.12.1 |
| CVE-2026-44000 | 7.2 | May 13 | vm2: sandbox boundary bypass via host Promise resolution preserving host object identity Affected: < 3.11.0 |
| CVE-2026-92959 | 7.1 | Sep 17 | vm2 before 3.11.8 allowAsync Bypass via Promise Thenable Affected: before 3.11.8 |
| CVE-2026-47141 | 6.9 | Jun 12 | vm2: NodeVM observability builtins leak host process and HTTP request data Affected: < 3.11.4 |
| CVE-2026-100722 | 6.8 | Sep 27 | vm2 before 3.12.2 Host Process Termination via Construct Trap Affected: before 3.12.2 |
| CVE-2026-92952 | 6.8 | Sep 17 | vm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering Bypass Affected: 3.11.4 before 3.11.7 |
| CVE-2026-92936 | 5.8 | Sep 17 | vm2 3.11.0 before 3.11.7 Information Disclosure via Error Stack Affected: 3.11.0 before 3.11.7 |
| CVE-2026-92933 | 5.8 | Sep 17 | vm2 before 3.11.8 Information Disclosure via util.getCallSites Affected: before 3.11.8 |
| CVE-2026-44003 | 5.8 | May 13 | vm2: Transformer Fast-Path Bypass Exposes Internal State Variable Affected: < 3.11.0 |
| CVE-2026-44002 | 5.8 | May 13 | vm2: Host File Path Disclosure via Stack Trace Information Leak Affected: < 3.11.0 |
| CVE-2026-92963 | 5.3 | Sep 17 | vm2 before 3.11.2 Information Disclosure via Internal State Affected: before 3.11.2 |
| CVE-2026-92945 | 4.2 | Sep 17 | vm2 before 3.11.7 Module Allowlist Bypass via Prefix Matching Affected: before 3.11.7 |
| CVE-2026-92949 | 4.0 | Sep 17 | vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptor Affected: 3.9.6 before 3.11.7 |
| CVE-2026-92962 | 2.1 | Sep 17 | vm2 before 3.11.4 Defense Invariant Violation via setup-sandbox.js Affected: before 3.11.4 |