npm/vm2 CVE-2026-44000: medium 6.5, EPSS 0.29%

vm2 Host Promise Resolution Preserves Object Identity Across Sandbox Boundary

Action: Upgrade vm2 to 3.11.0 or later.

npm i vm2@3.11.0

Affected

Fixed versions

Sources

• osv: GHSA-mpf8-4hx2-7cjg
• https://github.com/patriksimek/vm2/security/advisories/GHSA-mpf8-4hx2-7cjg
• https://nvd.nist.gov/vuln/detail/CVE-2026-44000
• https://github.com/patriksimek/vm2
• https://github.com/patriksimek/vm2/releases/tag/v3.11.0

CVE-2026-44000 · published 2026-05-07T04:29:22Z · modified 2026-05-14T20:51:05.427515Z · JSON