CVE-2026-44009Critical· 9.8▾ Midnightvm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, This vulnerability is fixed in 3.11.2.
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.8%
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, This vulnerability is fixed in 3.11.2.
vm2 < 3.11.2Upgrade past the affected range:
vm2 3.11.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-45411Critical· 9.8vm2 is an open source vm/sandbox for Node.js
CVE-2026-44008Critical· 9.8vm2 is an open source vm/sandbox for Node.js
CVE-2026-44005Critical· 10.0vm2 is an open source vm/sandbox for Node.js
CVE-2026-43997Critical· 10.0vm2 is an open source vm/sandbox for Node.js
CVE-2026-92940Critical· 10.0vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed code when a NodeVM is explicitly configured to allow require('https')
CVE-2026-44007Critical· 9.1vm2 is an open source vm/sandbox for Node.js