vm2 npm Package: Critical Auth Bypass and High-Severity Flaws Disclosed Together
Three vulnerabilities, including a critical authorization bypass and a high-severity buffer issue, were disclosed in the vm2 JavaScript sandbox, patched in version 3.12.2.
Key findings
- Three vulnerabilities in vm2, patched in 3.12.2, disclosed on September 27, 2026.
- Critical CVE-2026-100721 allows authorization bypass via custom external module resolvers.
- High CVE-2026-100723 involves improper Buffer invariant handling with exposed zlib module.
- Medium CVE-2026-100722 affects host-side Promise rejection handling in sandbox-to-host communication.
- Users should update to vm2 version 3.12.2 to patch these vulnerabilities.
On September 27, 2026, three vulnerabilities were disclosed in the npm package vm2, a JavaScript sandbox designed for Node.js. The vulnerabilities, all patched in version 3.12.2, were reported together and range in severity from medium to critical. These flaws could allow attackers to bypass sandbox restrictions, leading to potential authorization issues and arbitrary code execution.
One critical vulnerability (CVE-2026-100721) stems from an authorization bypass in the NodeVM external-module resolver. When a custom resolver is configured for require.external with context: 'host', the LegacyResolver.customResolve function incorrectly records the resolved module directory, potentially allowing unauthorized access.
A high-severity vulnerability (CVE-2026-100723) arises from vm2's failure to enforce its Buffer backing-store ownership invariant for Buffers returned from host builtin modules. This issue is particularly relevant when an application explicitly exposes Node.js's zlib module through NodeVM's built-in allowlist. The vulnerability lies in the handling of zlib.deflateSync, where the invariant is not applied, potentially leading to memory corruption or unexpected behavior.
Finally, a medium-severity vulnerability (CVE-2026-100722) affects vm2's handling of Promise rejections when communicating between the sandbox and the host. The apply trap in BaseHandler attempts to mark host promises as handled, but the construct path, used for object instantiation, does not apply the same sanitization. This could lead to unhandled Promise rejections escaping the sandbox and impacting the host environment.
All three vulnerabilities were addressed in version 3.12.2 of vm2. Users are strongly advised to update to this version to mitigate the risks associated with these security flaws. The coordinated disclosure of these vulnerabilities highlights the importance of keeping sandboxing environments up-to-date to prevent potential security breaches.