Critical Vulnerability in vm2 npm Package: Upgrade Now
- Severity
- CRITICAL
- CVSS
- 9
- Affected component
- vm2 (npm)
- Affected versions
- < 3.11.3 or < 3.11.2 or < 3.11.0 or < 3.9.10 or < 3.11.0 or < 3.11.0 or < 3.11.4 or < 3.9.6 or < 3.11.4 or < 3.9.15 or < 3.11.1 or >= 3.10.5, < 3.11.0 or >= 3.10.5, <= 3.10.5 or < 3.10.2 or < 3.11.4 or < 3.11.2 or < 3.11.2 or < 3.11.4 or < 3.10.0 or < 3.11.6 or < 3.9.17 or >= 3.10.5, < 3.11.0 or >= 3.10.5, <= 3.10.5 or < 3.10.5 or <= 3.9.19 or < 3.11.6 or < 3.11.0 or < 3.11.0 or < 3.11.6 or < 3.11.4 or < 3.11.4 or < 3.11.6 or < 3.11.0 or < 3.9.11 or < 3.9.18 or < 3.11.4 or < 3.11.0 or < 3.10.5 or < 3.11.4 or < 3.9.4 or < 3.11.4 or < 3.11.0 or < 3.11.0 or < 3.11.4 or < 3.11.6 or >= 3.9.6, < 3.11.0 or < 3.6.11 or < 3.9.18 or < 3.11.0 or < 3.9.16
- Patched version
- 3.11.8
The vm2 npm package before version 3.11.8 contains a critical vulnerability that allows sandbox escape and remote code execution. Users of affected versions are advised to upgrade immediately.
What happened
The vm2 npm package, used for running untrusted code in a sandboxed environment, has a critical vulnerability tracked as CVE-2026-92934, CVE-2026-92955, CVE-2026-92956, and GHSA-6J2X-VHQR-QR7Q. This vulnerability, with a CVSS score of 9, allows an attacker to escape the sandbox and execute arbitrary code on the host system. The issue arises from an incomplete fix for Error.cause sanitization, which can be exploited when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal.
The vulnerability was first flagged on 2026-09-17T14:17:57.513000+00:00 and confirmed shortly thereafter. Although it has not been exploited in the wild, the severity of the issue warrants immediate attention. The affected versions include any version before 3.11.8, as well as specific versions listed in the affected components section.
What to do about it
- Upgrade to vm2@3.11.8 or later to mitigate the vulnerability.
- Review all environments using vm2 for signs of compromise.
- Ensure that all dependencies are up to date and that no vulnerable versions of vm2 are in use.
- Monitor the primary sources for any updates or additional information regarding the vulnerability.
How 0Day would have caught this
vm2 is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using vm2 npm package version before 3.11.8 or any of the specific affected versions listed in the threat data.
What should I do right now?
Upgrade to vm2@3.11.8 or later and review your environments for signs of compromise.
Which versions of vm2 are safe to use?
Version 3.11.8 or later are considered safe. Ensure you are not using any of the affected versions listed in the threat data.