CVE-2026-100722 Overview
CVE-2026-100722 affects the vm2 sandbox library before version 3.12.2. The flaw resides in the sandbox-to-host construct trap inside BaseHandler. The apply trap calls markHostPromiseHandled() on returned values, but the adjacent construct path returns the result of Reflect.construct without the same sanitization. When an embedder exposes a constructable host function whose constructor returns a native rejected Promise, an untrusted script invoked through VM.run can call it with new and discard the result. The unhandled rejection crosses the sandbox bridge and, under Node.js strict unhandled-rejection policy, terminates the host process [CWE-248].
Critical Impact
Untrusted sandboxed scripts can crash the host Node.js process, producing a denial-of-service condition against any application relying on vm2 to isolate attacker-controlled code.
Affected Products
- vm2 npm package versions prior to 3.12.2
- Node.js applications embedding vm2 to execute untrusted JavaScript
- Platforms exposing constructable host functions through the vm2 bridge
Discovery Timeline
- 2026-09-27 - CVE-2026-100722 published to the National Vulnerability Database
- 2026-09-28 - Last updated in NVD database
Technical Details for CVE-2026-100722
Vulnerability Analysis
The defect is an uncaught exception issue classified under [CWE-248]. vm2 mediates calls between sandboxed scripts and host objects using Proxy traps defined in BaseHandler. The apply trap handles ordinary function calls and explicitly invokes markHostPromiseHandled() on returned values. This registration tells Node.js that any rejection on the returned Promise is being observed by the sandbox bridge, preventing promotion to a process-level unhandled rejection.
The construct trap, which handles new expressions targeting host functions, lacks the same post-processing step. It returns the raw result of Reflect.construct directly to the sandbox without marking any Promise returned by the constructor as handled. The attack vector is network-reachable because many vm2 deployments execute remote JavaScript submitted by untrusted users.
Root Cause
The construct path in BaseHandler omits the markHostPromiseHandled() call that the apply path performs. If a constructor returns a rejected Promise and the sandboxed script does not attach a rejection handler, Node.js observes an unhandled rejection on a host-side Promise. Under the strict --unhandled-rejections=strict policy, this is converted into an uncaught exception that terminates the process.
Attack Vector
An attacker supplies JavaScript executed through VM.run that invokes an exposed constructable host function with new and ignores the returned object. If that constructor returns a native rejected Promise, the rejection escapes the sandbox and crashes the host. The vulnerability requires the embedder to expose a constructable host function whose constructor can return a rejected Promise. Full exploitation details are documented in the GitHub Security Advisory GHSA-2v2p-6j97-cjg9 and the VulnCheck Advisory for vm2.
Detection Methods for CVE-2026-100722
Indicators of Compromise
- Abrupt termination of Node.js processes hosting vm2 sandboxes with UnhandledPromiseRejection entries in stderr or systemd journal logs.
- Repeated process restarts correlated with inbound requests that submit user-supplied JavaScript.
- Stack traces referencing BaseHandler construct paths or Reflect.construct near the point of termination.
Detection Strategies
- Inventory Node.js services with npm ls vm2 or Software Bill of Materials tooling to identify any version below 3.12.2.
- Instrument the host process with a process.on('uncaughtException') logger to capture crashes that originate from sandbox-returned Promises.
- Audit embedder code for constructable host functions exposed to the sandbox that may return Promises from their constructors.
Monitoring Recommendations
- Alert on process exit codes and restart loops for services that execute untrusted JavaScript.
- Forward Node.js runtime logs and container restart events to a centralized logging platform for correlation with request telemetry.
- Track Promise rejection warnings emitted by Node.js when --unhandled-rejections=warn is used in staging environments.
How to Mitigate CVE-2026-100722
Immediate Actions Required
- Upgrade vm2 to version 3.12.2 or later across all Node.js services.
- Audit which host functions are passed into the sandbox and remove constructable functions that are not required.
- Validate that embedder constructors do not return rejected Promises when invoked without arguments by untrusted callers.
Patch Information
The fix is included in vm2 version 3.12.2, which extends markHostPromiseHandled() coverage to the construct trap in BaseHandler. Refer to the GitHub Security Advisory GHSA-2v2p-6j97-cjg9 for commit references and release notes.
Workarounds
- Wrap exposed constructable host functions so their constructors never return a native Promise to the sandbox.
- Run Node.js with --unhandled-rejections=warn only as a temporary buffer; this changes crash behavior but does not fix the underlying bridge gap.
- Deploy sandboxed workloads in isolated worker processes supervised by a restart manager so a crash does not disrupt the main service.
# Upgrade vm2 to the patched release
npm install vm2@3.12.2
# Verify the installed version
npm ls vm2
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.