ZeroDay Findings
Sign inSign up

Findings

CVE-2026-44006

vm2 is an open source vm/sandbox for Node.js.

Published May 13, 2026 · updated Aug 6, 2026 · vm2 project vm2

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes. This vulnerability is fixed in 3.11.0.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. May 13, 2026 · NIST NVD

    Detected

    vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes. This vulnerability is fixed in 3.11.0.

  2. Aug 6, 2026 · NIST NVD

    Updated

    vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes. This vulnerability is fixed in 3.11.0.

Affected

  • cpe vm2 project/vm2version unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-44006

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-44006

    vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes. This vulnerability is fixed in 3.11.0.

    nvd.nist.gov

References