CVE-2026-44001: Vm2_project Vm2 RCE Vulnerability

CVE-2026-44001 Overview

CVE-2026-44001 is a sandbox escape vulnerability in vm2, an open source virtual machine and sandbox library for Node.js. Versions prior to 3.11.0 allow sandboxed code to crash the host Node.js process. An attacker triggers the flaw using a single Promise constructor that produces an unhandled rejection propagating from the sandbox to the host runtime. The earlier fix for CVE-2026-22709 in version 3.10.2 only sanitized the onRejected callback in .then() and .catch() overrides. That patch did not address the executor-to-unhandledRejection path that this issue abuses. The vulnerability is resolved in vm2 version 3.11.0. The weakness is classified as [CWE-248] Uncaught Exception.

Critical Impact

Any code executed inside a vm2 sandbox can crash the host Node.js process, producing a denial of service against applications that rely on vm2 to safely run untrusted JavaScript.

Affected Products

• vm2 versions prior to 3.11.0
• vm2 v3.10.5 (explicitly confirmed in the advisory)
• Node.js applications embedding vm2 to execute untrusted code

Discovery Timeline

• 2026-05-13 - CVE-2026-44001 published to the National Vulnerability Database
• 2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-44001

Vulnerability Analysis

The vm2 library wraps untrusted JavaScript so it can execute inside a contained context separate from the host Node.js process. To preserve this isolation, vm2 overrides several built-in primitives that can otherwise leak host references into the sandbox. Among these are Promise.prototype.then and Promise.prototype.catch, which were hardened previously to sanitize the onRejected handler argument.

This vulnerability bypasses that hardening by routing the rejection through a different code path. Sandboxed code constructs a Promise whose executor function rejects synchronously or asynchronously. Because the override layer never intercepts the executor path, the resulting rejection is not wrapped or contained within the sandbox. The unhandled rejection propagates to the host Node.js event loop, where it triggers the host's unhandledRejection handling and terminates the process.

The scope is changed (S:C in the CVSS vector) because code limited to the sandbox affects the security of a component outside it, namely the host runtime. Confidentiality and integrity are not impacted, but availability is fully lost.

Root Cause

The root cause is an incomplete fix for CVE-2026-22709. The original patch sanitized callbacks passed to .then() and .catch() overrides but did not sanitize rejections originating from the Promise constructor's executor function. Rejections produced through that path are not associated with a sandbox-controlled handler, so Node.js raises the unhandledRejection event in the host context and exits.

Attack Vector

The attack requires only the ability to submit JavaScript that runs inside a vm2 sandbox. No authentication, user interaction, or network access to the host is required beyond the existing sandbox entry point. An attacker submits a payload that constructs a Promise whose executor rejects without an attached .catch() chain handled by the sanitized overrides. The host Node.js process then crashes, causing denial of service for every workload sharing that process.

No verified public proof of concept code is available. Refer to the GitHub Security Advisory GHSA-hw58-p9xv-2mjh for the maintainer's technical description.

Detection Methods for CVE-2026-44001

Indicators of Compromise

• Repeated abnormal exits of Node.js processes hosting vm2, often with exit code 1 and an unhandledRejection message in stderr.
• Process supervisor logs (systemd, pm2, forever, Kubernetes) showing restart loops correlated with sandbox job submissions.
• Application logs containing UnhandledPromiseRejection traces referencing vm2/lib/main.js or sandbox-related frames.

Detection Strategies

• Inventory all Node.js services and identify those that depend on vm2 at a version below 3.11.0 using npm ls vm2 or software composition analysis tooling.
• Monitor for spikes in Node.js process restarts on hosts that evaluate untrusted scripts, plugins, or user-supplied expressions.
• Correlate sandbox job submission events with process termination events to find the input that triggered the crash.

Monitoring Recommendations

• Forward stderr and crash logs from Node.js workers to a centralized logging pipeline and alert on unhandledRejection patterns.
• Track child process exit codes for services that run vm2, and treat sudden increases in non-zero exits as a denial of service signal.
• Capture the offending sandbox payload when available so engineering can reproduce and confirm exploitation.

How to Mitigate CVE-2026-44001

Immediate Actions Required

• Upgrade vm2 to version 3.11.0 or later in all Node.js projects and rebuild affected container images.
• Audit lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml) to ensure no transitive dependency pins a vulnerable vm2 version.
• Restrict who can submit code to any vm2-backed evaluation endpoint until the upgrade is verified in production.

Patch Information

The maintainers fixed CVE-2026-44001 in vm23.11.0. The patch closes the executor-to-unhandledRejection propagation path that the prior CVE-2026-22709 fix missed. Review the GitHub Security Advisory GHSA-hw58-p9xv-2mjh for the official remediation guidance from the vm2 project.

Note that the vm2 project has been deprecated by its maintainer. Teams that cannot move to 3.11.0 should plan migration to an actively maintained sandboxing approach such as isolated-vm or running untrusted code in a separate process or container with strict resource limits.

Workarounds

• Run each vm2 evaluation inside a short-lived child process or worker thread so a crash isolates the failure from the main service.
• Wrap calls to vm.run() with a process-level process.on('unhandledRejection', ...) handler that logs and swallows the rejection, accepting the documented Node.js risk of doing so.
• Place the Node.js service behind a supervisor that restarts the process quickly and rate-limit submissions of untrusted scripts to reduce crash-loop impact.

# Upgrade vm2 to the patched release
npm install vm2@3.11.0 --save
npm ls vm2