CVE-2026-44001: vm2 has a Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)

May 7, 2026 (updated May 14, 2026)

A sandbox escape vulnerability in vm2 v3.10.5 allows any sandboxed code to crash the host Node.js process via a single Promise constructor that triggers an unhandled rejection propagating to the host. The fix for CVE-2026-22709 (v3.10.2) only sanitized the onRejected callback in .then() and .catch() overrides and did not address the executor-to-unhandledRejection path.

References

github.com/advisories/GHSA-99p7-6v5w-7xg8
github.com/advisories/GHSA-hw58-p9xv-2mjh
github.com/patriksimek/vm2/releases/tag/v3.11.0
github.com/patriksimek/vm2/security/advisories/GHSA-hw58-p9xv-2mjh
nvd.nist.gov/vuln/detail/CVE-2026-44001

Code Behaviors & Features

Detect and mitigate CVE-2026-44001 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →