CVE-2026-43998 patriksimek CVE debrief

Who should care

Developers and administrators using vm2 version 3.10.5 or earlier should be concerned about this vulnerability. They should update to version 3.11.0 or later to prevent potential attacks. Additionally, users of Node.js applications that utilize vm2 should also be aware of this vulnerability and take steps to mitigate it.

Technical summary

The vulnerability in vm2 arises from the use of path.resolve() for path validation, which does not dereference symlinks, while module loading uses Node's native require(), which does. This discrepancy allows an attacker to create a symlink to a module outside the allowed root directory, effectively bypassing the path restriction. The attacker can then load arbitrary host-realm modules, leading to remote code execution. The vulnerability has a CVSS score of 8.5 and is classified as HIGH severity.

Defensive priority

High priority should be given to updating vm2 to version 3.11.0 or later. In the meantime, defenders should monitor for potential exploitation attempts and restrict access to sensitive areas of the system.

Recommended defensive actions

• Update vm2 to version 3.11.0 or later
• Monitor for potential exploitation attempts
• Restrict access to sensitive areas of the system
• Implement additional security measures, such as intrusion detection and prevention systems
• Conduct regular vulnerability assessments and penetration testing

Evidence notes

The CVE-2026-43998 vulnerability was published on May 13, 2026, and last modified on June 30, 2026. The vulnerability has a CVSS score of 8.5 and is classified as HIGH severity. The vulnerability affects vm2 version 3.10.5 and earlier. The fix for this vulnerability is included in vm2 version 3.11.0.

Official resources