CVE-2026-92954 patriksimek CVE debrief

Who should care

Defenders responsible for Node.js applications using the vm2 sandbox library should assess exposure and verify if their systems are using affected versions. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure that their environments are protected against potential host process termination via unhandled Promises.

Why it matters

Defenders should care about CVE-2026-92954 because it affects the vm2 sandbox library used in Node.js applications, potentially allowing for host process termination via unhandled Promises. This vulnerability requires verification of vm2 version usage and potentially upgrading to version 3.11.8 or later for a fix.

• Potential host process termination due to unhandled Promises
• Possible denial-of-service (DoS) attacks
• Need for verification of vm2 version usage in Node.js applications
• Importance of upgrading to vm2 version 3.11.8 or later for fix

Technical summary

The vm2 sandbox library for running untrusted JavaScript in Node.js has a vulnerability in versions between 3.10.0 and 3.11.7. The issue arises from Promises returned from the host realm into the sandbox not being marked as handled at the bridge boundary, allowing sandbox code to invoke host functions that return rejected Promises and ignore the return value, leading to Node.js's default unhandled-rejection behavior terminating the host process.

Defensive priority

Defenders should prioritize assessing exposure to vm2 versions between 3.10.0 and 3.11.7 and verify if their systems are using affected versions.

Recommended defensive actions

• Assess exposure to vm2 versions between 3.10.0 and 3.11.7
• Verify if systems are using affected versions
• Consider upgrading to vm2 version 3.11.8 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in vm2, a sandbox library for running untrusted JavaScript in Node.js. The issue arises from Promises returned from the host realm into the sandbox not being marked as handled at the bridge boundary.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.