If the prerequisites are met, attackers can break out of the vm2 sandbox on a Node.js instance and execute malicious code. A proof-of-concept exploit is public, but so far there are no reports of attackers exploiting the vulnerability. The developers have since released a security update.
A warning message on GitHub indicates that the vulnerability (CVE-2026-26956) is classified as “ critical ” in terms of threat level. The developers assure that only Node.js 25 is threatened by this. They state that they have successfully reproduced the vulnerability in v25.6.1. Specifically, version 3.10.4 of vm2 is vulnerable. The vulnerability has been fixed in version 3.10.5 . However, instances are only attackable if WebAssembly exception handling and JSTag support are active.
If this is the case, attackers can trigger errors with prepared requests, thereby bypassing the vm2 security filters. Subsequently, they can execute their code on the host system. Due to the classification, it can be assumed that systems will subsequently be considered fully compromised. The developers provide further details on the vulnerability and a possible attack scenario in the warning message .
This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
