THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-44001 (HIGH 8.6) — vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox escape vulnerability in vm2 v3.10.5 allows any sandboxed code to crash the host Node.js process via a single Promise constructor that triggers an unhandled rejection propagating to the host. The fix for CVE-

[NVD] CVE-2026-44001 (HIGH 8.6) — vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox escape vulnerability in vm2 v3.10.5 allows any sandboxed code to crash the host Node.js process via a single Promise constructor that triggers an unhandled rejection propagating to the host. The fix for CVE-

lownvdPublished 2026-05-13

CVE-2026-44001 CVSS: 8.6 HIGH Published: 2026-05-13T18:16:16.720

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox escape vulnerability in vm2 v3.10.5 allows any sandboxed code to crash the host Node.js process via a single Promise constructor that triggers an unhandled rejection propagating to the host. The fix for CVE-2026-22709 (v3.10.2) only sanitized the onRejected cal

Indicators of compromise

CVE-2026-44001cve
CVE-2026-22709cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-44001