CVE-2026-92959

CVE-2026-92959 affects vm2 (a Node.js sandboxing library) versions prior to 3.11.8 . The vulnerability lies in the incomplete enforcement of the allowAsync: false option in VM and NodeVM. Although localPromise.prototype.then is patched to throw 'Async not available', the sandbox's Promise static ...

EUVD-2026-81608

vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.prototype.then is replaced with a handler that throws 'Async not available', the sandbox's Promise static methods Promise.resolve, Promise.all, Promise.race, Promise.any, and...