GHSA-9538-79J2-H62H Duplicate Advisory: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f8gf-w286-fmq2. This link is maintained to preserve external references. Original Description vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While...

GHSA-VJCV-9J33-WJ62 Duplicate Advisory: vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-r4fx-v8hh-22mv. This link is maintained to preserve external references. Original Description vm2 before 3.11.7 affected versions = 3.11.6 does not enforce the VM timeout option on code executed outside the...

CVE-2026-92959

vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.prototype.then is replaced with a handler that throws 'Async not available', the sandbox's Promise static methods Promise.resolve, Promise.all, Promise.race, Promise.any, and...

CVE-2026-92942

vm2 before 3.11.7 affected versions = 3.11.6 does not enforce the VM timeout option on code executed outside the synchronous VMrun call. The timeout only wraps the single call to runScript via doWithTimeout in lib/vm.js, and FinalizationRegistry and WeakRef are exposed to sandboxed code unmodifie...

CVE-2026-92959 vm2 before 3.11.8 allowAsync Bypass via Promise Thenable

vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.prototype.then is replaced with a handler that throws 'Async not available', the sandbox's Promise static methods Promise.resolve, Promise.all, Promise.race, Promise.any, and...

CVE-2026-92959

CVE-2026-92959 affects vm2 (a Node.js sandboxing library) versions prior to 3.11.8 . The vulnerability lies in the incomplete enforcement of the allowAsync: false option in VM and NodeVM. Although localPromise.prototype.then is patched to throw 'Async not available', the sandbox's Promise static ...

CVE-2026-92959 vm2 before 3.11.8 allowAsync Bypass via Promise Thenable

vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.prototype.then is replaced with a handler that throws 'Async not available', the sandbox's Promise static methods Promise.resolve, Promise.all, Promise.race, Promise.any, and...

CVE-2026-92959 vm2 before 3.11.8 allowAsync Bypass via Promise Thenable

vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.prototype.then is replaced with a handler that throws 'Async not available', the sandbox's Promise static methods Promise.resolve, Promise.all, Promise.race, Promise.any, and...

CVE-2026-92942

vm2 before 3.11.7 (versions ≤ 3.11.6) contains a timeout bypass that allows sandboxed code to trigger denial of service. The VM({ timeout }) option only wraps the synchronous VM#run() call, while FinalizationRegistry and WeakRef are exposed to sandboxed code unmodified. An attacker can register a...

CVE-2026-92942 vm2 before 3.11.7 Timeout Bypass via FinalizationRegistry

vm2 before 3.11.7 affected versions = 3.11.6 does not enforce the VM timeout option on code executed outside the synchronous VMrun call. The timeout only wraps the single call to runScript via doWithTimeout in lib/vm.js, and FinalizationRegistry and WeakRef are exposed to sandboxed code unmodifie...

CVE-2026-92942 vm2 before 3.11.7 Timeout Bypass via FinalizationRegistry

vm2 before 3.11.7 affected versions = 3.11.6 does not enforce the VM timeout option on code executed outside the synchronous VMrun call. The timeout only wraps the single call to runScript via doWithTimeout in lib/vm.js, and FinalizationRegistry and WeakRef are exposed to sandboxed code unmodifie...

CVE-2026-92942 vm2 before 3.11.7 Timeout Bypass via FinalizationRegistry

vm2 before 3.11.7 affected versions = 3.11.6 does not enforce the VM timeout option on code executed outside the synchronous VMrun call. The timeout only wraps the single call to runScript via doWithTimeout in lib/vm.js, and FinalizationRegistry and WeakRef are exposed to sandboxed code unmodifie...

CVE-2026-90127: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: virtio: rtc: time out alarm requests RTC class operations run with rtcdevice.opslock held. The virtio RTC alarm requests currently wait without a timeout for the device to return their requestq buffers. On surprise removal,...

CVE-2026-93157: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: hwrng: xilinx-trng - propagate timeout before any data is read xtrngreadblock32 polls for 16-byte chunks but returns the number of bytes read even when the first poll times out. Its caller then treats a zero return as a short...

CVE-2026-92959: Protection Mechanism Failure

vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.prototype.then is replaced with a handler that throws 'Async not available', the sandbox's Promise static methods Promise.resolve, Promise.all, Promise.race, Promise.any, and...

CVE-2026-93153: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/bngre: return a timeout when firmware responses stall waitforresp documents that it returns a non-zero error when a firmware command does not complete, and bngrercfwsendmessage already marks the firmware as stalled when the...

CVE-2026-93156: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: crypto: rk3288 - fail ahash requests on HASH idle timeout rkhashrun waits for RKCRYPTOHASHSTS to become idle after the final DMA transfer, but ignores the poll result. If the hash engine never becomes idle, the driver still reads...

PT-2026-94604

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the Bluetooth L2CAP implementation. The l2cap data member of hci conn is accessed without proper locking within the l2cap disconn ind function, which...

PT-2026-94949

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/bng re component where the wait for resp function ignores the expiry of wait event timeout. If a response slot remains in use after the timeout and a polled...

PT-2026-94964

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A CPU stall occurs in the xilinx dma poll timeout function when it is called with the delay us variable set to 0 and a condition is never fulfilled. This is caused by a significant...