CVE-2026-92956 vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming

vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default new VM sandbox when running on Node.js 26. WebAssembly.compileStreaming and WebAssembly.instantiateStreaming can produce a raw host-realm Promise that rejects with a host-realm error object; by controlling...

CVE-2026-92956

vm2 versions 3.10.1 through 3.11.6 are vulnerable to a sandbox escape on Node.js 26 that requires only a default new VM() configuration. The root cause is that WebAssembly.compileStreaming and WebAssembly.instantiateStreaming can produce a raw host-realm Promise rejecting with a host-realm error ...