CVE-2026-92942

vm2 before 3.11.7 (affected versions <= 3.11.6) does not enforce the VM({ timeout }) option on code executed outside the synchronous VM#run() call. The timeout only wraps the single call to _runScript() via doWithTimeout() in lib/vm.js, and FinalizationRegistry and WeakRef are exposed to sandboxed code unmodified (they are not among the hardened globals in lib/setup-sandbox.js). Sandboxed code can register a FinalizationRegistry cleanup callback against an object and then drop the only strong reference to it; vm.run() returns within the configured timeout, but when the V8 garbage collector later reclaims the object it invokes the sandboxed cleanup callback outside any vm2 timeout accounting. A busy loop in that callback blocks the host event loop for an unbounded period, resulting in denial of service. The time of invocation depends on the garbage collector (e.g. under memory pressure or with --expose-gc).

• CWE-400

• https://github.com/patriksimek/vm2/security/advisories/GHSA-r4fx-v8hh-22mv
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-timeout-bypass-via-finalizationregistry
• https://github.com/patriksimek/vm2/security/advisories/GHSA-r4fx-v8hh-22mv

Published

Sep 17, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-92937vm2 3.11.6 is vulnerable to a sandbox escape leading to remo…10
• CVE-2026-92938vm2 versions 3.11.3 through 3.11.6 expose Node.js's host nod…9.9
• CVE-2026-92939vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto mo…9.9
• CVE-2026-9294A vulnerability was identified in Edimax BR-6428NS 1.10. The…8.8
• CVE-2026-92940vm2 versions 3.11.3 through 3.11.6 expose the host process's…10
• CVE-2026-92941vm2 versions from 3.11.3 before 3.11.7 expose the host tls m…10
• CVE-2026-92943Improper validation of certificate with host mismatch in the…8.1
• CVE-2026-92944vm2 versions 3.10.2 through 3.11.6 contain a sandbox escape …9.8
• CVE-2026-92945vm2 before 3.11.7 contains a module allowlist bypass vulnera…4.2
• CVE-2026-92946vm2 before 3.11.7 contains a remote code execution vulnerabi…10
• CVE-2026-92947vm2 before 3.11.7 exposes Node's shared Buffer pool to sandb…10
• CVE-2026-92948vm2 versions >= 3.9.6 and <= 3.11.6 are affected by a NodeVM…9.9