CVE-2026-100722
Deferred Deferred - Pending Action

Promise Rejection Handling Flaw in vm2

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: VulnCheck

Description
vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromiseHandled() on the returned value, but the adjacent construct path returns the result of Reflect.construct without the same sanitization. If an embedder exposes a constructable host function whose constructor returns a native rejected Promise, an untrusted script executed via VM.run can invoke it with `new` and ignore the result; the rejected host Promise crosses the bridge unhandled and, under Node's strict unhandled-rejection policy, is promoted to an uncaught exception that terminates the host process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2026-100722
EUVD
EUVD-2026-87857

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
patriksimek vm2 to 3.12.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-248 An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-100722 is a vulnerability in the vm2 library (versions before 3.12.2) where an untrusted script executed via VM.run can terminate the host Node.js process. The issue occurs when a host function exposed in the VM sandbox returns a rejected native Promise. The sandbox-to-host construct trap does not properly handle this Promise rejection, unlike the apply trap. This causes Node.js's strict unhandled-rejection policy to terminate the process.

Detection Guidance

Check if your system uses vm2 versions <= 3.12.1 by running: npm list vm2. If the version is vulnerable, update to vm2 3.12.2 or later immediately.

Impact Analysis

This vulnerability can lead to denial of service by crashing the host Node.js process. An attacker could exploit it by submitting malicious JavaScript to a VM with a constructable Promise-returning host API. The impact is limited to host availability, as the crash is a process-level failure rather than a guest exception.

Compliance Impact

This vulnerability primarily causes host process termination due to unhandled Promise rejections, which could lead to denial of service in systems processing sensitive data. For GDPR, this may impact availability of personal data processing systems, potentially violating Article 32 requirements for resilience. HIPAA-covered entities might face disruptions in critical healthcare operations, affecting availability of protected health information systems under the Security Rule.

Mitigation Strategies

Upgrade vm2 to version 3.12.2 or higher using: npm update vm2. If upgrading is not possible, restrict access to VM.run and exposed constructable host functions to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100722. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart