vm2 has 5 CVEs on record. 5 were published in the last 90 days. The busiest recent month was August 2026 with 5. The median CVSS is 9.8 (critical), with 3 rated critical. None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 9.8
- Publish → KEV
- —
- Last 90 days
- 5 prev 0
Worst active — by depth score
GHSA-m5w8-4gq2-6f8xCritical· 10.0vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)55CVE-2026-47686Critical· 9.9vm2 is an open source vm/sandbox for Node.js55CVE-2026-47698Critical· 9.8vm2 is an open source vm/sandbox for Node.js54GHSA-v836-6xw4-9cx3High· 7.5vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass41CVE-2026-47683High· 7.5vm2 is an open source vm/sandbox for Node.js41
vm2 vulnerabilities
CVEs affecting vm2, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-47683High· 7.5vm2 is an open source vm/sandbox for Node.js
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, the bufferAllocLimit enforcement in lib/setup-sandbox.js does not cover Buffer.concat(list, totalLength) or Buffer.from(arrayLike) with an attacker-controlled length, allowin…
CVE-2026-47686Critical· 9.9vm2 is an open source vm/sandbox for Node.js
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, handleException() in lib/setup-sandbox.js sanitizes SuppressedError.error, SuppressedError.suppressed, and AggregateError.errors but does not sanitize Error.cause, allowing s…
CVE-2026-47698Critical· 9.8vm2 is an open source vm/sandbox for Node.js
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, lib/bridge.js and lib/setup-sandbox.js fail to block stacked indirection through Function.prototype.call around dangerous host prototype getter and setter mutators, allowing …
GHSA-m5w8-4gq2-6f8xCritical· 10.0vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)
vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)
GHSA-v836-6xw4-9cx3High· 7.5vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass
vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass