npm / vm2

vm2

What changed in vm2 3, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.

38 breaking116 security1 deprecations2 new APIs and options1 behavior and defaults6 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli on npm

vm2 3164 changes

Breaking changes 38

Host views that do not own their whole backing store are delivered bounded, preventing sandbox access to unrelated host buffers; their buffer and parent are exact-size copies and byteOffset and offset read as 0.
3.12.2release notes security advisory
Custom resolver answers are now authorized by boundary-matched paths; {module, path} answers must name a package inside path, preventing sibling-package authorization.
3.12.2release notes security advisory
In NodeVM, crypto.setFips is replaced with a throwing stub so guest code cannot change the FIPS mode of the host process; getFips() and the rest of crypto are unchanged.
3.12.1release notes
NodeVM no longer allows child_process through require.builtin, whether requested by wildcard or by name; embedders needing it can re-expose it through require.mock.
3.12.1release notes
A sloppy-mode host function called with a nullish receiver now sees undefined instead of the host global, preventing access to the host realm through this.
3.12.1release notes
With allowAsync: false, assimilating Promise static methods and Array.fromAsync now throw in the sandbox, and the native Promise base is not constructable from sandbox code.
3.11.8release notes
Raw host __proto__ getters and prototype-reading APIs can no longer be delivered to sandbox code to climb host prototype chains.
3.11.8release notes
The sandbox util builtin is now a vetted allowlist; host-introspection and host-mutation members are no longer forwarded, including through the deprecated sys alias.
3.11.8release notes
Denying a builtin family now also denies its subpath siblings; explicitly list a subpath if it must remain available.
3.11.7release notes
Sandbox-supplied paths can no longer use the OpenSSL ENGINE loader to execute a native library in the host process.
3.11.7release notes security advisory
FinalizationRegistry is no longer a sandbox global by default because cleanup callbacks are not bounded by timeout.
3.11.7release notes
Host frames are redacted from errors caught in the sandbox; messages are preserved, while absolute host paths and Node, file, and wasm frames are removed.
3.11.7release notes
The real shared host HTTP agent is no longer exposed to sandbox code, preventing access to host request options and sockets.
3.11.7release notes security advisory
The sandbox can no longer load native SQLite extensions into the host process through DatabaseSync.
3.11.7release notes security advisory
The test builtin family, including subpaths, is denied and refused on explicit request because its run API can spawn a host process.
3.11.7release notes
Truthy nesting configuration with a non-config require value now throws at construction instead of producing an unrestricted nested resolver.
3.11.7release notes
External allowlist checks no longer admit substring-sharing package names or permitted subpaths containing .. segments.
3.11.7release notes security advisory
External allowlist authorization no longer treats prefix-sharing sibling packages as allowlisted, including scoped package names.
3.11.7release notes security advisory
Requiring vm2 from disk under require.external can no longer construct an unrestricted nested NodeVM.
3.11.7release notes security advisory
FinalizationRegistry cleanup callbacks can run outside timeout enforcement, so they can no longer be exposed by default.
3.11.7release notes security advisory
Sandbox code can no longer replace the host thread's process-wide default CA trust store.
3.11.7release notes security advisory
Frozen host objects no longer expose accessor setters through descriptor-reading paths; getter reads remain available.
3.11.7release notes
The CLI now confines requires to the target script's directory and loads them inside the sandbox; scripts needing host modules should be run with node directly.
3.11.7release notes
WeakRef is no longer a sandbox global by default; it can be re-exposed through the sandbox option.
3.11.7release notes
Streaming WebAssembly APIs are removed from the sandbox because their Promises could expose host rejections; non-streaming WebAssembly APIs are unaffected.
3.11.7release notes
Finite limits now also cover Buffer.concat, Buffer.from, Buffer.copyBytesFrom, ArrayBuffer, SharedArrayBuffer, TypedArray, and WebAssembly.Memory allocations. The default Infinity is unaffected.
3.11.6release notes
NodeVM builtin: ['*'] no longer exposes os or dns, including node:os, node:dns, and dns/promises. Re-introduce a safe subset via require.mock or require.override.
3.11.6release notes
Host errors reach sandbox catch blocks as sandbox-realm errors; primitive diagnostics and subclass instanceof behavior are preserved, while non-primitive properties and the host prototype chain are removed.
3.11.6release notes
Sandbox-installed Array prototype setters or join overrides can no longer observe bridge-internal stack-trace state.
3.11.4release notes security advisory
The builtin denylist bypass through process and inspector/promises is fixed; explicitly listing the named unsafe builtins now throws at load time.
3.11.4release notes security advisory
The builtin allowlist no longer surfaces process-wide observability modules that could expose host process state.
3.11.4release notes security advisory
A truthy nesting value without an explicit require config object now makes construction throw; drop nesting or provide a require config object.
3.11.4release notes security advisory
Constructing a NodeVM with { nesting: true, require: false } now throws VMError, preventing the contradictory configuration from enabling sandbox-to-host RCE.
3.11.1release notes security advisory
Custom fs adapters used with require.root must implement realpathSync, or realpath() for a fully custom FileSystem class; otherwise NodeVM construction now throws a VMError.
3.11.0release notes security advisory
Adds trace_events to the dangerous-builtins denylist after a Proxy<Array> category triggered a C++ assertion that aborted the host process.
3.11.0release notes
Adds wasi to the denylist because its experimental syscall surface is too broad for default '*' exposure.
3.11.0release notes
Blocks all code-executing constructors from crossing the bridge through property descriptors.
3.10.5release notes
Blocks access to the Function constructor through getOwnPropertyDescriptor.
3.10.5release notes

Security 116

Host promises delivered to the sandbox are marked handled on every route, so ignored promises no longer trigger host unhandledRejection; sandbox code can still observe rejections through its sanitized .catch.
3.12.2release notes security advisory
Sandbox-initiated then, catch, and finally calls on exposed host promises now use a genuine host Promise for the result capability, preventing host settlement values from escaping into the sandbox.
3.12.1release notes
vm2 contains a sandbox escape vulnerability
3.12.1security advisory
Bun support is experimental and compatibility is partial; JavaScriptCore has not been audited against vm2's bridge, so do not use vm2 on Bun to isolate untrusted code.
3.12.0release notes
Error-carrier cycles no longer re-embed raw host proxies in rebuilt errors arrays delivered to sandbox catch code.
3.11.8release notes security advisory
The default VM now protects binary-data and iterator intrinsic prototypes from host-state corruption through a host Buffer proto-walk.
3.11.8release notes security advisory
vm2: allowAsync: false can be bypassed through Promise thenable assimilation in VM and NodeVM
3.11.8security advisory
vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix
3.11.8security advisory
vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process
3.11.8security advisory
vm2: Sandbox Escape (NodeVM)
3.11.8security advisory
vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit
3.11.8security advisory
vm2: util.getCallSites() bypasses GHSA-v27g-jcqj-v8rw host-frame redaction, leaks host call stack
3.11.8security advisory
Buffer creation no longer gives sandbox code access to Node's shared allocation pool, preventing disclosure or corruption of neighboring host buffers.
3.11.7release notes security advisory
Wildcard builtin expansion now applies deny tokens using canonical names, so a node:-prefixed deny token blocks its corresponding builtin.
3.11.7release notes security advisory
The apply-trap gate now handles indirection through call and apply, preventing raw host Promise rejections from reaching sandbox code.
3.11.7release notes security advisory
Promise then and catch wrappers are installed in a way that protects against Node 26's native fast path exposing host Promise reactions to sandbox code.
3.11.7release notes security advisory
vm2 allows a sandboxed plugin to execute native code through node:sqlite
3.11.7security advisory
vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts
3.11.7security advisory
vm2 crypto builtin loads attacker native code through setEngine
3.11.7security advisory
vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package
3.11.7security advisory
vm2 exposes host HTTPS credentials and TLS traffic through globalAgent
3.11.7security advisory
vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted
3.11.7security advisory
vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection
3.11.7security advisory
vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks
3.11.7security advisory release notes
vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting
3.11.7security advisory
vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape
3.11.7security advisory
vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes
3.11.7security advisory
vm2 NodeVM can replace the host process TLS trust store
3.11.7security advisory
vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE
3.11.7security advisory
vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process
3.11.7security advisory
vm2: NodeVM require.external without an explicit require.root grants unrestricted host filesystem access and full RCE
3.11.7security advisory
vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector
3.11.7security advisory
vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass
3.11.7security advisory
vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool
3.11.7security advisory
vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)
3.11.7security advisory
vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor
3.11.7security advisory
vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass
3.11.6security advisory
VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE
3.11.6security advisory
vm2: NodeVM builtin: ['*'] exposes os and dns — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)
3.11.6security advisory
vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike
3.11.6security advisory
vm2: Sandbox Breakout Using Dangerous Host Proto Mutators
3.11.6security advisory
Promise species hijacking in the swallow-tail is fixed, preventing access to a raw host-realm error.
3.11.4release notes security advisory
NodeVM builtin denylist bypass via process and inspector/promises allows host code execution
3.11.4security advisory
The builtin wildcard no longer exposes undocumented underscored network builtins despite documented network exclusions.
3.11.4release notes security advisory
NodeVM network builtin exclusions bypass via internal _http_client and _http_server
3.11.4security advisory
NodeVM observability builtins leak host process and HTTP request data
3.11.4security advisory
Prototype mutation through function and Reflect indirection is fixed, preventing host intrinsic prototype chains from being severed.
3.11.4release notes security advisory
The bridge set trap now honors the ECMA-262 Receiver, preventing writes through child objects or Reflect.set from leaking onto host objects.
3.11.4release notes security advisory
vm2 has a CVE-2023-37903 patch bypass: nesting:true without explicit require still allows full RCE
3.11.4security advisory
vm2 has a Sandbox Escape issue
3.11.4security advisory
vm2 has a sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks
3.11.4security advisory release notes
vm2 is Vulnerable to Sandbox Breakout Through Promise Species
3.11.4security advisory
vm2's Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain
3.11.4security advisory
vm2 sandbox escape via JSPI-backed Promise .finally() species bypass
3.11.4security advisory
vm2 setup-sandbox.js violates Defense Invariant #11 in stack-trace formatter
3.11.4security advisory
The JSPI host-realm Promise prototype-chain issue is fixed, preventing species hijacking from delivering a raw host-realm rejection to sandbox catch handlers.
3.11.4release notes security advisory
Fixes an exception-capture issue involving async generator yield* returns and thenables that could lead to RCE.
3.11.3release notes security advisory
vm2 Has a Sandbox Breakout Using Async Generator
3.11.3security advisory
Fixes a bridge saved-state leak involving a sandbox-installed Array.prototype[N] setter that could lead to RCE.
3.11.2release notes security advisory
Fixes an issue that made internal state reachable through computed-key access on globalThis.
3.11.2release notes security advisory
vm2 has access to VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL
3.11.2security advisory
vm2 has Sandbox Breakout Through Null Proto Exception
3.11.2security advisory release notes
vm2 has sandbox breakout via neutralizeArraySpeciesBatch
3.11.2security advisory
vm2 NodeVM nesting: true bypasses require: false allowing sandbox escape and arbitrary OS command execution
3.11.1security advisory
Closes an array species self-return sandbox escape that could enable remote code execution.
3.11.0release notes security advisory
Prevents host intrinsic prototype pollution via bridge write traps.
3.11.0release notes security advisory
Addresses host-heap denial of service from unbounded Buffer.alloc requests; bufferAllocLimit can cap individual requests.
3.11.0release notes security advisory
Closes a sandbox escape involving symbol extraction from host objects across realms.
3.11.0release notes security advisory
Closes a sandbox escape involving a trap method on a leaked handler with a forged target.
3.11.0release notes security advisory
Closes a bypass of the NodeVM builtin allowlist via host-passthrough builtins.
3.11.0release notes security advisory
Closes host-process denial of service from unhandled rejections caused by Promise executor throws; async rejection paths still require a host-side handler.
3.11.0release notes security advisory
Closes a sandbox escape involving Promise structural leaks and SuppressedError or AggregateError sanitisation.
3.11.0release notes security advisory
Closes a sandbox escape involving host Promise fulfillment callbacks and sanitiser-callback null-prototype unwrapping.
3.11.0release notes security advisory
Adds realpath() to the DefaultFileSystem and VMFileSystem contracts so require.root boundary checks can canonicalize candidate paths before checking the prefix.
3.11.0release notes
Canonicalizes candidate paths with realpath before the root prefix check, closing a symlink bypass that could escape the allowed root.
3.11.0release notes
Embedders running untrusted async code should install a host-side handler because the fix cannot reach some async rejection paths.
3.11.0release notes
vm2 Access to Host Object Enables Sandbox Escape
3.11.0security advisory
vm2 has a NodeVM builtin allowlist bypass via module builtin's Module._load that allows sandbox escape
3.11.0security advisory
vm2 has a NodeVM require.root bypass via symlink traversal that allows sandbox escape
3.11.0security advisory
VM2 Has a Sandbox Escape Issue via SuppressedError
3.11.0security advisory
vm2 has a Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)
3.11.0security advisory
vm2 has a Sandbox Escape Vulnerability
3.11.0security advisory
VM2 Has Sandbox Breakout Through Inspect Function
3.11.0security advisory release notes
vm2 Host Promise Resolution Preserves Object Identity Across Sandbox Boundary
3.11.0security advisory
vm2 is Vulnerable to Host File Path Disclosure via Stack Trace Information Leak
3.11.0security advisory release notes
vm2: Mutable Proxies for Host Intrinsic Prototypes Allows Sandbox Escape
3.11.0security advisory
vm2's Transformer Fast-Path Bypass Exposes Internal State Variable
3.11.0security advisory release notes
vm2 Sandbox Access to Host Buffer.alloc Allows timeout Bypass Resulting in Memory Exhaustion
3.11.0security advisory
VM2 Sandbox Breakout Through __lookupGetter__
3.11.0security advisory
Blocks the Function constructor from crossing the bridge regardless of access path.
3.10.5release notes
Blocks extraction of the Function constructor through nested property descriptors.
3.10.5release notes
Blocks a host Function constructor leak through a direct handler.get() call.
3.10.5release notes
Prevents proxy unwrapping that could expose the Function constructor through Object.entries.
3.10.5release notes
Sanitizes SuppressedError sub-errors to prevent sandbox escape.
3.10.5release notes
Prevents sandbox escape through doPreventExtensions exposure in util.inspect.
3.10.5release notes
Prevents sandbox escape through getFactory exposure in util.inspect.
3.10.5release notes
VM2 Has a WASM Sandbox Escape
3.10.5security advisory
VM2 Has Sandbox Breakout Through Promise Species
3.10.5security advisory
Blocks WebAssembly.JSTag to prevent a wasm-level exception catch sandbox escape in Node 25.
3.10.5release notes
Prevents sandbox escape through fromOtherWithContext exposure in util.inspect.
3.10.4release notes
Prevents sandbox escape via Promise static method stealing.
3.10.4release notes
Prevents sandbox escape through proxy handler exposure in util.inspect.
3.10.4release notes
Prevents sandbox escape via a Reflect.construct Promise species bypass.
3.10.4release notes
Prevents a hasOwnProperty override from bypassing Symbol.for protections.
3.10.3release notes
Prevents object key coercion from bypassing Symbol.for protections.
3.10.3release notes
Prevents cross-realm symbol extraction through Object.getOwnPropertySymbols.
3.10.3release notes
Prevents sandbox escape through Promise species manipulation.
3.10.3release notes
Prevents a Symbol.species getter TOCTOU bypass when resetting Promise species.
3.10.3release notes
Eliminates Promise species TOCTOU by unconditionally overriding the constructor.
3.10.3release notes
Prevents sandbox escape via static method stealing from Promise.try.
3.10.3release notes
Prevents cross-realm symbol extraction via the spread operator on bridge proxies.
3.10.3release notes
Prevents sandbox escape via cross-realm symbols.
3.10.3release notes
vm2 has a Sandbox Escape
3.10.2security advisory
Fixed a vulnerability that bypassed Promise callback sanitization.
3.10.1release notes
Upstream security fixes were incorporated.
3.10.0release notes
vm2 Sandbox Escape vulnerability
3.10.0security advisory

Deprecations 1

Using require.external without require.root now emits a one-time warning; its breadth is unchanged in this release.
3.11.7release notes

New APIs and options 2

Adds a VM and NodeVM option accepting a non-negative number or Infinity to cap individual Buffer.alloc family requests from inside the sandbox; its default is Infinity.
3.11.0release notes
Support for the TypeScript compiler was added.
3.10.0release notes

Behavior and default changes 1

Bun compile, esbuild, pkg, and other single-file bundlers can now ship vm2 because sandbox bootstrap files are embedded in generated lib/sources.js instead of read from disk at runtime.
3.12.2release notes

Fixes and other changes 6

The sandbox Proxy install is wrapped in try/catch so JavaScriptCore throwing on the sealed slot no longer aborts sandbox setup before the first run().
3.12.0release notes
Fixes the .node extension handler key so native addon resolution no longer silently falls through to the default path.
3.11.5release notes
Restores underlying-value output when inspecting sandbox results on Node 26+, instead of rendering nested Proxy wrappers.
3.11.5release notes
Restores array iteration methods on frozen host arrays used inside the sandbox.
3.11.5release notes
Allows Object.setPrototypeOf on sandbox-local objects.
3.10.5release notes
Promise handlers use Reflect.apply instead of .call().
3.10.2release notes