CVE-2026-92959 patriksimek CVE debrief

Who should care

Defenders responsible for Node.js environments using vm2 should assess exposure and prioritize updating to version 3.11.8 or later to prevent potential async bypass via promise thenables.

Why it matters

Defenders should care about CVE-2026-92959 because it allows sandboxed scripts in vm2 to bypass the allowAsync: false option, potentially leading to execution outside configured timeouts. This requires verification of vm2 versions and updating to 3.11.8 or later to prevent async bypass via promise thenables. Evidence is limited to CVE and NVD records, with some vendor advisories.

• Potential for sandboxed scripts to execute outside configured timeouts
• Bypass of allowAsync: false option in VM and NodeVM
• Possible scheduling of work after VM.run() or NodeVM.run() has returned

Technical summary

The vm2 library before version 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM, allowing sandboxed scripts to schedule work outside the configured timeout via promise thenables. This vulnerability can lead to execution outside configured timeouts. Defenders should verify vm2 versions and update to 3.11.8 or later to prevent async bypass via promise thenables. The vulnerability is triggered by native promise resolution performing PromiseResolveThenableJob and invoking the sandboxed code's then method in a microtask without passing through the patched then.

Defensive priority

Defenders should prioritize verifying vm2 versions and updating to 3.11.8 or later to prevent async bypass via promise thenables.

Recommended defensive actions

• Verify vm2 version and update to 3.11.8 or later
• Review and adjust allowAsync option configurations
• Monitor for potential async bypass attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but vendor confirmation and additional impact details are limited. Evidence is limited to CVE and NVD records, with some vendor advisories. Defenders should verify vm2 versions and update to 3.11.8 or later to prevent async bypass via promise thenables. Limited source detail suggests explicit evidence-limit language and defensive verification tasks are required.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.