{"action":"Upgrade vm2 to 3.12.2 or later.","affected":[{"fixed":"3.12.2","introduced":"0"}],"component":"vm2","cve_ids":["CVE-2026-100722"],"ecosystem":"npm","epss":0.00315,"exploited":false,"fixed_versions":["3.12.2"],"ghsa_id":"GHSA-2v2p-6j97-cjg9","id":"tcs_01M5KEV2CQDS6X02ZJB8FA1H9E","modified_at":"2026-10-05T23:30:04.641523138Z","published_at":"2026-10-05T23:19:55Z","references":["https://osv.dev/vulnerability/GHSA-2v2p-6j97-cjg9","https://github.com/patriksimek/vm2/security/advisories/GHSA-2v2p-6j97-cjg9","https://nvd.nist.gov/vuln/detail/CVE-2026-100722","https://github.com/patriksimek/vm2/commit/6e487df9518e455e5e60faec3df3a0e2e27f9940","https://github.com/patriksimek/vm2","https://github.com/patriksimek/vm2/releases/tag/v3.12.2","https://www.vulncheck.com/advisories/vm2-before-3.12.2-host-process-termination-via-construct-trap"],"severity":{"label":"high","score":8.6},"sources":[{"source":"osv","source_id":"GHSA-2v2p-6j97-cjg9","url":"https://osv.dev/vulnerability/GHSA-2v2p-6j97-cjg9"}],"summary":"vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process"}