CVE-2026-92954 vm2 3.10.0 through 3.11.5 Denial of Service via Host Promise

vm2 is a sandbox library for running untrusted JavaScript in Node.js. In versions = 3.10.0 and = 3.11.7, Promises returned from the host realm into the sandbox are not marked as handled at the bridge boundary; only Promises created inside the sandbox are wrapped with a rejection-swallowing handle...