CVE-2026-44000: vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox boundary violation in vm2 allows host object id…
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox boundary violation in vm2 allows host object identity to cross into the sandbox through host Promise resolution. When a host-side Promise that resolves to a host object is exposed to the sandbox, the value delivered to the sandbox .then() callback preserves host identity. This allows the sandbox to interact with the host object directly, including performing identity checks using host-side WeakMap and mutating host object state from inside the sandbox. This behavior occurs because the Promise fulfillment wrapper uses ensureThis() instead of the stronger cross-realm conversion path (from() / proxy wrapping). If no prototype mapping is found, ensureThis() returns the original object. As a result, objects resolved by host Promises can cross the sandbox boundary without proper isolation. This vulnerability is fixed in 3.11.0.
- Published by source
- 2026-05-13
- First seen by Reality Radar
- 2026-10-26
- Last verified
- 2026-10-26
Affected
- Manufacturer
- vm2 project
- Products
- vm2
- Versions
- <3.11.0
- CPE
- cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:node.js:*:*
Whether your exact unit is affected depends on the model, serial number and region in the official notice.
What the official notice says
Risk: CVSS 7.2
Is this affecting you?
Add what you own or use and Reality Radar will tell you when official changes match it — with evidence and next steps.
Sources
- NIST National Vulnerability Database Tier A · official published 2026-05-13
Evidence ledger
Every piece of evidence we store is appended to a public hash chain, so later edits are detectable. Anyone can re-verify it.
| Entry | Kind | Observed | Evidence hash | Entry hash |
|---|---|---|---|---|
| #1835 | new | 2026-10-26 | c0daba91497d…0a7d27 | ad1d75573df0…9e9d8a |
Chain head: #1913 68d492d71c09…880c23