CVE-2026-92944 patriksimek CVE debrief

Who should care

Node.js 26 and vm2 version 3.10.2 through 3.11.6 users, particularly those using vm2 in production environments, should assess their exposure and take necessary actions to mitigate the vulnerability.

Why it matters

CVE-2026-92944 is a critical vulnerability in vm2 that allows for sandbox escape and arbitrary code execution on Node.js 26. Users of affected vm2 versions should assess their exposure and apply patches or mitigations as soon as possible.

• Potential for arbitrary code execution on the host system.
• Bypass of vm2's wrapper protections.
• Possible disruption of service or data integrity.
• Need for verification of affected versions and exposure in the environment.

Technical summary

The vulnerability exists in vm2 versions 3.10.2 through 3.11.6 on Node.js 26. An attacker can exploit this by creating an async function that returns a Promise with an attacker-controlled constructor Symbol.species, allowing them to reach the host Function constructor and process object for arbitrary code execution. This is due to a stale PromiseThenLookupChain protector in V8 14.6, which allows bypassing vm2's wrapper protections using Promise.prototype.finally(). Users of affected vm2 versions should assess their exposure and apply patches or mitigations as soon as possible.

Defensive priority

High priority for Node.js 26 and vm2 versions 3.10.2 through 3.11.6 users to assess exposure and apply patches or mitigations.

Recommended defensive actions

• Assess exposure of Node.js 26 and vm2 versions 3.10.2 through 3.11.6 in your environment.
• Verify if patches or updates are available for vm2.
• Implement compensating controls to monitor and restrict usage of affected vm2 versions.
• Review and update inventory of Node.js and vm2 deployments.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its critical CVSS score of 9.3. However, the exact scope of affected systems and potential exploitation remain unclear. Defenders should verify affected vm2 versions in their environment and review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. The vulnerability exists in vm2 versions 3.10.2 through 3.11.6 on Node.js 26, and attackers can exploit this by creating an async function that returns a Promise

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.