# What changed in vm2

> 164 changes in vm2 3 from its official release notes, upgrade guides and advisories: 38 breaking, 1 deprecations, 116 security, 2 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/vm2/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## vm2 3

### Breaking changes

- Host views that do not own their whole backing store are delivered bounded, preventing sandbox access to unrelated host buffers; their buffer and parent are exact-size copies and byteOffset and offset read as 0. (3.12.2) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.12.2), [security advisory](https://github.com/advisories/GHSA-489W-W794-JQ94)
- Custom resolver answers are now authorized by boundary-matched paths; {module, path} answers must name a package inside path, preventing sibling-package authorization. (3.12.2) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.12.2), [security advisory](https://github.com/advisories/GHSA-5H3F-Q97H-CCVC)
- In NodeVM, crypto.setFips is replaced with a throwing stub so guest code cannot change the FIPS mode of the host process; getFips() and the rest of crypto are unchanged. (3.12.1) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.12.1)
- NodeVM no longer allows child_process through require.builtin, whether requested by wildcard or by name; embedders needing it can re-expose it through require.mock. (3.12.1) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.12.1)
- A sloppy-mode host function called with a nullish receiver now sees undefined instead of the host global, preventing access to the host realm through this. (3.12.1) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.12.1)
- With `allowAsync: false`, assimilating Promise static methods and `Array.fromAsync` now throw in the sandbox, and the native Promise base is not constructable from sandbox code. (3.11.8) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.8)
- Raw host `__proto__` getters and prototype-reading APIs can no longer be delivered to sandbox code to climb host prototype chains. (3.11.8) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.8)
- The sandbox util builtin is now a vetted allowlist; host-introspection and host-mutation members are no longer forwarded, including through the deprecated sys alias. (3.11.8) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.8)
- Denying a builtin family now also denies its subpath siblings; explicitly list a subpath if it must remain available. (3.11.7) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.7)
- Sandbox-supplied paths can no longer use the OpenSSL ENGINE loader to execute a native library in the host process. (3.11.7) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.7), [security advisory](https://github.com/advisories/GHSA-46PR-C5WC-XFFX)
- FinalizationRegistry is no longer a sandbox global by default because cleanup callbacks are not bounded by timeout. (3.11.7) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.7)
- Host frames are redacted from errors caught in the sandbox; messages are preserved, while absolute host paths and Node, file, and wasm frames are removed. (3.11.7) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.7)
- The real shared host HTTP agent is no longer exposed to sandbox code, preventing access to host request options and sockets. (3.11.7) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.7), [security advisory](https://github.com/advisories/GHSA-H85J-HV3C-QFGQ)
- The sandbox can no longer load native SQLite extensions into the host process through DatabaseSync. (3.11.7) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.7), [security advisory](https://github.com/advisories/GHSA-6W8R-XXW2-G3HX)
- The test builtin family, including subpaths, is denied and refused on explicit request because its run API can spawn a host process. (3.11.7) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.7)
- Truthy nesting configuration with a non-config `require` value now throws at construction instead of producing an unrestricted nested resolver. (3.11.7) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.7)
- External allowlist checks no longer admit substring-sharing package names or permitted subpaths containing `..` segments. (3.11.7) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.7), [security advisory](https://github.com/advisories/GHSA-C48M-32M9-VX93)
- External allowlist authorization no longer treats prefix-sharing sibling packages as allowlisted, including scoped package names. (3.11.7) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.7), [security advisory](https://github.com/advisories/GHSA-7Q3F-WX44-378M)
- Requiring `vm2` from disk under `require.external` can no longer construct an unrestricted nested NodeVM. (3.11.7) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.7), [security advisory](https://github.com/advisories/GHSA-J3HM-6RG5-MCHV)
- FinalizationRegistry cleanup callbacks can run outside timeout enforcement, so they can no longer be exposed by default. (3.11.7) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.7), [security advisory](https://github.com/advisories/GHSA-R4FX-V8HH-22MV)
- Sandbox code can no longer replace the host thread's process-wide default CA trust store. (3.11.7) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.7), [security advisory](https://github.com/advisories/GHSA-98XX-8MX4-X7CM)
- Frozen host objects no longer expose accessor setters through descriptor-reading paths; getter reads remain available. (3.11.7) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.7)
- The CLI now confines requires to the target script's directory and loads them inside the sandbox; scripts needing host modules should be run with node directly. (3.11.7) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.7)
- WeakRef is no longer a sandbox global by default; it can be re-exposed through the sandbox option. (3.11.7) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.7)
- Streaming WebAssembly APIs are removed from the sandbox because their Promises could expose host rejections; non-streaming WebAssembly APIs are unaffected. (3.11.7) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.7)
- Finite limits now also cover Buffer.concat, Buffer.from, Buffer.copyBytesFrom, ArrayBuffer, SharedArrayBuffer, TypedArray, and WebAssembly.Memory allocations. The default Infinity is unaffected. (3.11.6) — [release notes](https://github.com/patriksimek/vm2/releases/tag/3.11.6)
- NodeVM builtin: ['*'] no longer exposes os or dns, including node:os, node:dns, and dns/promises. Re-introduce a safe subset via require.mock or require.override. (3.11.6) — [release notes](https://github.com/patriksimek/vm2/releases/tag/3.11.6)
- Host errors reach sandbox catch blocks as sandbox-realm errors; primitive diagnostics and subclass instanceof behavior are preserved, while non-primitive properties and the host prototype chain are removed. (3.11.6) — [release notes](https://github.com/patriksimek/vm2/releases/tag/3.11.6)
- Sandbox-installed Array prototype setters or join overrides can no longer observe bridge-internal stack-trace state. (3.11.4) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.4), [security advisory](https://github.com/advisories/GHSA-Q3FM-4WCW-G57X)
- The builtin denylist bypass through process and inspector/promises is fixed; explicitly listing the named unsafe builtins now throws at load time. (3.11.4) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.4), [security advisory](https://github.com/advisories/GHSA-RP36-8XQ3-R6C4)
- The builtin allowlist no longer surfaces process-wide observability modules that could expose host process state. (3.11.4) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.4), [security advisory](https://github.com/advisories/GHSA-9G8X-92Q2-P28F)
- A truthy nesting value without an explicit require config object now makes construction throw; drop nesting or provide a require config object. (3.11.4) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.4), [security advisory](https://github.com/advisories/GHSA-M4WX-M65X-GHRR)
- Constructing a NodeVM with `{ nesting: true, require: false }` now throws VMError, preventing the contradictory configuration from enabling sandbox-to-host RCE. (3.11.1) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.1), [security advisory](https://github.com/advisories/GHSA-8HG8-63C5-GWMX)
- Custom fs adapters used with require.root must implement realpathSync, or realpath() for a fully custom FileSystem class; otherwise NodeVM construction now throws a VMError. (3.11.0) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.0), [security advisory](https://github.com/advisories/GHSA-CP6G-6699-WX9C)
- Adds trace_events to the dangerous-builtins denylist after a Proxy<Array> category triggered a C++ assertion that aborted the host process. (3.11.0) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.0)
- Adds wasi to the denylist because its experimental syscall surface is too broad for default '*' exposure. (3.11.0) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.0)
- Blocks all code-executing constructors from crossing the bridge through property descriptors. (3.10.5) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.10.5)
- Blocks access to the Function constructor through getOwnPropertyDescriptor. (3.10.5) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.10.5)

### Security

- Host promises delivered to the sandbox are marked handled on every route, so ignored promises no longer trigger host unhandledRejection; sandbox code can still observe rejections through its sanitized .catch. (3.12.2) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.12.2), [security advisory](https://github.com/advisories/GHSA-2V2P-6J97-CJG9)
- Sandbox-initiated then, catch, and finally calls on exposed host promises now use a genuine host Promise for the result capability, preventing host settlement values from escaping into the sandbox. (3.12.1) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.12.1)
- vm2 contains a sandbox escape vulnerability (3.12.1) — [security advisory](https://github.com/advisories/GHSA-PQ68-RVW4-XP4R)
- Bun support is experimental and compatibility is partial; JavaScriptCore has not been audited against vm2's bridge, so do not use vm2 on Bun to isolate untrusted code. (3.12.0) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.12.0)
- Error-carrier cycles no longer re-embed raw host proxies in rebuilt errors arrays delivered to sandbox catch code. (3.11.8) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.8), [security advisory](https://github.com/advisories/GHSA-X965-FC75-JPQH)
- The default VM now protects binary-data and iterator intrinsic prototypes from host-state corruption through a host Buffer proto-walk. (3.11.8) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.8), [security advisory](https://github.com/advisories/GHSA-3VGF-8M4Q-Q4QR)
- vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM (3.11.8) — [security advisory](https://github.com/advisories/GHSA-F8GF-W286-FMQ2)
- vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix (3.11.8) — [security advisory](https://github.com/advisories/GHSA-3VGF-8M4Q-Q4QR)
- vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process (3.11.8) — [security advisory](https://github.com/advisories/GHSA-GJQ8-XM47-88RC)
- vm2: Sandbox Escape (NodeVM) (3.11.8) — [security advisory](https://github.com/advisories/GHSA-88HF-G992-JG85)
- vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit (3.11.8) — [security advisory](https://github.com/advisories/GHSA-X965-FC75-JPQH)
- vm2: util.getCallSites() bypasses GHSA-v27g-jcqj-v8rw host-frame redaction, leaks host call stack (3.11.8) — [security advisory](https://github.com/advisories/GHSA-R273-HXVJ-FXHP)
- Buffer creation no longer gives sandbox code access to Node's shared allocation pool, preventing disclosure or corruption of neighboring host buffers. (3.11.7) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.7), [security advisory](https://github.com/advisories/GHSA-FCQC-726X-5WFC)
- Wildcard builtin expansion now applies deny tokens using canonical names, so a `node:`-prefixed deny token blocks its corresponding builtin. (3.11.7) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.7), [security advisory](https://github.com/advisories/GHSA-8686-VHFX-7R3J)
- The apply-trap gate now handles indirection through call and apply, preventing raw host Promise rejections from reaching sandbox code. (3.11.7) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.7), [security advisory](https://github.com/advisories/GHSA-647F-G98J-QQ25)
- Promise then and catch wrappers are installed in a way that protects against Node 26's native fast path exposing host Promise reactions to sandbox code. (3.11.7) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.7), [security advisory](https://github.com/advisories/GHSA-27G9-P43V-CW3V)
- vm2 allows a sandboxed plugin to execute native code through `node:sqlite` (3.11.7) — [security advisory](https://github.com/advisories/GHSA-6W8R-XXW2-G3HX)
- vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts (3.11.7) — [security advisory](https://github.com/advisories/GHSA-JXXV-8R27-VM4P)
- vm2 crypto builtin loads attacker native code through setEngine (3.11.7) — [security advisory](https://github.com/advisories/GHSA-46PR-C5WC-XFFX)
- vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package (3.11.7) — [security advisory](https://github.com/advisories/GHSA-C48M-32M9-VX93)
- vm2 exposes host HTTPS credentials and TLS traffic through globalAgent (3.11.7) — [security advisory](https://github.com/advisories/GHSA-H85J-HV3C-QFGQ)
- vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted (3.11.7) — [security advisory](https://github.com/advisories/GHSA-7Q3F-WX44-378M)
- vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection (3.11.7) — [security advisory](https://github.com/advisories/GHSA-647F-G98J-QQ25)
- vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks (3.11.7) — [security advisory](https://github.com/advisories/GHSA-JF8Q-945G-9Q4C), [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.7)
- vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting (3.11.7) — [security advisory](https://github.com/advisories/GHSA-X6M4-CHR9-CG97)
- vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape (3.11.7) — [security advisory](https://github.com/advisories/GHSA-QHWX-74W5-XHXQ)
- vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes (3.11.7) — [security advisory](https://github.com/advisories/GHSA-6RH5-QQ4Q-97XH)
- vm2 NodeVM can replace the host process TLS trust store (3.11.7) — [security advisory](https://github.com/advisories/GHSA-98XX-8MX4-X7CM)
- vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE (3.11.7) — [security advisory](https://github.com/advisories/GHSA-8HR7-R645-PC6W)
- vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process (3.11.7) — [security advisory](https://github.com/advisories/GHSA-8686-VHFX-7R3J)
- vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE (3.11.7) — [security advisory](https://github.com/advisories/GHSA-J3HM-6RG5-MCHV)
- vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector (3.11.7) — [security advisory](https://github.com/advisories/GHSA-27G9-P43V-CW3V)
- vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass (3.11.7) — [security advisory](https://github.com/advisories/GHSA-WJWH-QQVP-G4P4)
- vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool (3.11.7) — [security advisory](https://github.com/advisories/GHSA-FCQC-726X-5WFC)
- vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block) (3.11.7) — [security advisory](https://github.com/advisories/GHSA-R4FX-V8HH-22MV)
- vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor (3.11.7) — [security advisory](https://github.com/advisories/GHSA-633R-HQ9M-C4FF)
- vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass (3.11.6) — [security advisory](https://github.com/advisories/GHSA-V836-6XW4-9CX3)
- VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE (3.11.6) — [security advisory](https://github.com/advisories/GHSA-M283-3H24-438V)
- vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f) (3.11.6) — [security advisory](https://github.com/advisories/GHSA-M5W8-4GQ2-6F8X)
- vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike (3.11.6) — [security advisory](https://github.com/advisories/GHSA-GMC2-2X9W-CGH9)
- vm2: Sandbox Breakout Using Dangerous Host Proto Mutators (3.11.6) — [security advisory](https://github.com/advisories/GHSA-CFCW-XP6X-25GJ)
- Promise species hijacking in the swallow-tail is fixed, preventing access to a raw host-realm error. (3.11.4) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.4), [security advisory](https://github.com/advisories/GHSA-76W7-J9CQ-RX2J)
- NodeVM builtin denylist bypass via process and inspector/promises allows host code execution (3.11.4) — [security advisory](https://github.com/advisories/GHSA-RP36-8XQ3-R6C4)
- The builtin wildcard no longer exposes undocumented underscored network builtins despite documented network exclusions. (3.11.4) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.4), [security advisory](https://github.com/advisories/GHSA-R9PM-GXMW-WV6P)
- NodeVM network builtin exclusions bypass via internal _http_client and _http_server (3.11.4) — [security advisory](https://github.com/advisories/GHSA-R9PM-GXMW-WV6P)
- NodeVM observability builtins leak host process and HTTP request data (3.11.4) — [security advisory](https://github.com/advisories/GHSA-9G8X-92Q2-P28F)
- Prototype mutation through function and Reflect indirection is fixed, preventing host intrinsic prototype chains from being severed. (3.11.4) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.4), [security advisory](https://github.com/advisories/GHSA-V6MX-MF47-R5WG)
- The bridge set trap now honors the ECMA-262 Receiver, preventing writes through child objects or Reflect.set from leaking onto host objects. (3.11.4) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.4), [security advisory](https://github.com/advisories/GHSA-C4CF-2HGV-2QV6)
- vm2 has a CVE-2023-37903 patch bypass: nesting:true without explicit require still allows full RCE (3.11.4) — [security advisory](https://github.com/advisories/GHSA-M4WX-M65X-GHRR)
- vm2 has a Sandbox Escape issue (3.11.4) — [security advisory](https://github.com/advisories/GHSA-V6MX-MF47-R5WG)
- vm2 has a sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks (3.11.4) — [security advisory](https://github.com/advisories/GHSA-M5Q2-4FM3-VFQP), [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.4)
- vm2 is Vulnerable to Sandbox Breakout Through Promise Species (3.11.4) — [security advisory](https://github.com/advisories/GHSA-76W7-J9CQ-RX2J)
- vm2's Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain (3.11.4) — [security advisory](https://github.com/advisories/GHSA-C4CF-2HGV-2QV6)
- vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass (3.11.4) — [security advisory](https://github.com/advisories/GHSA-6J2X-VHQR-QR7Q)
- vm2 setup-sandbox.js violates Defense Invariant #11 in stack-trace formatter (3.11.4) — [security advisory](https://github.com/advisories/GHSA-Q3FM-4WCW-G57X)
- The JSPI host-realm Promise prototype-chain issue is fixed, preventing species hijacking from delivering a raw host-realm rejection to sandbox catch handlers. (3.11.4) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.4), [security advisory](https://github.com/advisories/GHSA-6J2X-VHQR-QR7Q)
- Fixes an exception-capture issue involving async generator yield* returns and thenables that could lead to RCE. (3.11.3) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.3), [security advisory](https://github.com/advisories/GHSA-248R-7H7Q-CR24)
- vm2 Has a Sandbox Breakout Using Async Generator (3.11.3) — [security advisory](https://github.com/advisories/GHSA-248R-7H7Q-CR24)
- Fixes a bridge saved-state leak involving a sandbox-installed Array.prototype[N] setter that could lead to RCE. (3.11.2) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.2), [security advisory](https://github.com/advisories/GHSA-9QJ6-QJGG-37QQ)
- Fixes an issue that made internal state reachable through computed-key access on globalThis. (3.11.2) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.2), [security advisory](https://github.com/advisories/GHSA-2CM2-M3W5-GP2F)
- vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL` (3.11.2) — [security advisory](https://github.com/advisories/GHSA-2CM2-M3W5-GP2F)
- vm2 has Sandbox Breakout Through Null Proto Exception (3.11.2) — [security advisory](https://github.com/advisories/GHSA-9VG3-4RFJ-WGCM), [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.2)
- vm2 has sandbox breakout via `neutralizeArraySpeciesBatch` (3.11.2) — [security advisory](https://github.com/advisories/GHSA-9QJ6-QJGG-37QQ)
- vm2 NodeVM `nesting: true` bypasses `require: false` allowing sandbox escape and arbitrary OS command execution (3.11.1) — [security advisory](https://github.com/advisories/GHSA-8HG8-63C5-GWMX)
- Closes an array species self-return sandbox escape that could enable remote code execution. (3.11.0) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.0), [security advisory](https://github.com/advisories/GHSA-GRJ5-JJM8-H35P)
- Prevents host intrinsic prototype pollution via bridge write traps. (3.11.0) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.0), [security advisory](https://github.com/advisories/GHSA-VWRP-X96C-MHWQ)
- Addresses host-heap denial of service from unbounded Buffer.alloc requests; bufferAllocLimit can cap individual requests. (3.11.0) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.0), [security advisory](https://github.com/advisories/GHSA-6785-PVV7-MVG7)
- Closes a sandbox escape involving symbol extraction from host objects across realms. (3.11.0) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.0), [security advisory](https://github.com/advisories/GHSA-47X8-96VW-5WG6)
- Closes a sandbox escape involving a trap method on a leaked handler with a forged target. (3.11.0) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.0), [security advisory](https://github.com/advisories/GHSA-QCP4-V2JJ-FJX8)
- Closes a bypass of the NodeVM builtin allowlist via host-passthrough builtins. (3.11.0) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.0), [security advisory](https://github.com/advisories/GHSA-947F-4V7F-X2V8)
- Closes host-process denial of service from unhandled rejections caused by Promise executor throws; async rejection paths still require a host-side handler. (3.11.0) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.0), [security advisory](https://github.com/advisories/GHSA-HW58-P9XV-2MJH)
- Closes a sandbox escape involving Promise structural leaks and SuppressedError or AggregateError sanitisation. (3.11.0) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.0), [security advisory](https://github.com/advisories/GHSA-55HX-C926-FR95)
- Closes a sandbox escape involving host Promise fulfillment callbacks and sanitiser-callback null-prototype unwrapping. (3.11.0) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.0), [security advisory](https://github.com/advisories/GHSA-MPF8-4HX2-7CJG)
- Adds realpath() to the DefaultFileSystem and VMFileSystem contracts so require.root boundary checks can canonicalize candidate paths before checking the prefix. (3.11.0) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.0)
- Canonicalizes candidate paths with realpath before the root prefix check, closing a symlink bypass that could escape the allowed root. (3.11.0) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.0)
- Embedders running untrusted async code should install a host-side handler because the fix cannot reach some async rejection paths. (3.11.0) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.0)
- vm2 Access to Host Object Enables Sandbox Escape (3.11.0) — [security advisory](https://github.com/advisories/GHSA-47X8-96VW-5WG6)
- vm2 has a NodeVM builtin allowlist bypass via `module` builtin's `Module._load` that allows sandbox escape (3.11.0) — [security advisory](https://github.com/advisories/GHSA-947F-4V7F-X2V8)
- vm2 has a NodeVM require.root bypass via symlink traversal that allows sandbox escape (3.11.0) — [security advisory](https://github.com/advisories/GHSA-CP6G-6699-WX9C)
- VM2 Has a Sandbox Escape Issue via SuppressedError (3.11.0) — [security advisory](https://github.com/advisories/GHSA-55HX-C926-FR95)
- vm2 has a Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS) (3.11.0) — [security advisory](https://github.com/advisories/GHSA-HW58-P9XV-2MJH)
- vm2 has a Sandbox Escape Vulnerability (3.11.0) — [security advisory](https://github.com/advisories/GHSA-QCP4-V2JJ-FJX8)
- VM2 Has Sandbox Breakout Through Inspect Function (3.11.0) — [security advisory](https://github.com/advisories/GHSA-V37H-5MFM-C47C), [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.0)
- vm2 Host Promise Resolution Preserves Object Identity Across Sandbox Boundary (3.11.0) — [security advisory](https://github.com/advisories/GHSA-MPF8-4HX2-7CJG)
- vm2 is Vulnerable to Host File Path Disclosure via Stack Trace Information Leak (3.11.0) — [security advisory](https://github.com/advisories/GHSA-V27G-JCQJ-V8RW), [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.0)
- vm2: Mutable Proxies for Host Intrinsic Prototypes Allows Sandbox Escape (3.11.0) — [security advisory](https://github.com/advisories/GHSA-VWRP-X96C-MHWQ)
- vm2's Transformer Fast-Path Bypass Exposes Internal State Variable (3.11.0) — [security advisory](https://github.com/advisories/GHSA-WP5R-2GW5-M7Q7), [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.0)
- vm2 Sandbox Access to Host Buffer.alloc Allows timeout Bypass Resulting in Memory Exhaustion (3.11.0) — [security advisory](https://github.com/advisories/GHSA-6785-PVV7-MVG7)
- VM2 Sandbox Breakout Through __lookupGetter__ (3.11.0) — [security advisory](https://github.com/advisories/GHSA-GRJ5-JJM8-H35P)
- Blocks the Function constructor from crossing the bridge regardless of access path. (3.10.5) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.10.5)
- Blocks extraction of the Function constructor through nested property descriptors. (3.10.5) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.10.5)
- Blocks a host Function constructor leak through a direct handler.get() call. (3.10.5) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.10.5)
- Prevents proxy unwrapping that could expose the Function constructor through Object.entries. (3.10.5) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.10.5)
- Sanitizes SuppressedError sub-errors to prevent sandbox escape. (3.10.5) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.10.5)
- Prevents sandbox escape through doPreventExtensions exposure in util.inspect. (3.10.5) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.10.5)
- Prevents sandbox escape through getFactory exposure in util.inspect. (3.10.5) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.10.5)
- VM2 Has a WASM Sandbox Escape (3.10.5) — [security advisory](https://github.com/advisories/GHSA-FFH4-J6H5-PG66)
- VM2 Has Sandbox Breakout Through Promise Species (3.10.5) — [security advisory](https://github.com/advisories/GHSA-QVJJ-29QF-HP7P)
- Blocks WebAssembly.JSTag to prevent a wasm-level exception catch sandbox escape in Node 25. (3.10.5) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.10.5)
- Prevents sandbox escape through fromOtherWithContext exposure in util.inspect. (3.10.4) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.10.4)
- Prevents sandbox escape via Promise static method stealing. (3.10.4) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.10.4)
- Prevents sandbox escape through proxy handler exposure in util.inspect. (3.10.4) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.10.4)
- Prevents sandbox escape via a Reflect.construct Promise species bypass. (3.10.4) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.10.4)
- Prevents a hasOwnProperty override from bypassing Symbol.for protections. (3.10.3) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.10.3)
- Prevents object key coercion from bypassing Symbol.for protections. (3.10.3) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.10.3)
- Prevents cross-realm symbol extraction through Object.getOwnPropertySymbols. (3.10.3) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.10.3)
- Prevents sandbox escape through Promise species manipulation. (3.10.3) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.10.3)
- Prevents a Symbol.species getter TOCTOU bypass when resetting Promise species. (3.10.3) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.10.3)
- Eliminates Promise species TOCTOU by unconditionally overriding the constructor. (3.10.3) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.10.3)
- Prevents sandbox escape via static method stealing from Promise.try. (3.10.3) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.10.3)
- Prevents cross-realm symbol extraction via the spread operator on bridge proxies. (3.10.3) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.10.3)
- Prevents sandbox escape via cross-realm symbols. (3.10.3) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.10.3)
- vm2 has a Sandbox Escape (3.10.2) — [security advisory](https://github.com/advisories/GHSA-99P7-6V5W-7XG8)
- Fixed a vulnerability that bypassed Promise callback sanitization. (3.10.1) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.10.1)
- Upstream security fixes were incorporated. (3.10.0) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.10.0)
- vm2 Sandbox Escape vulnerability (3.10.0) — [security advisory](https://github.com/advisories/GHSA-CCHQ-FRGV-RJH5)

### Deprecations

- Using require.external without require.root now emits a one-time warning; its breadth is unchanged in this release. (3.11.7) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.7)

### New APIs and options

- Adds a VM and NodeVM option accepting a non-negative number or Infinity to cap individual Buffer.alloc family requests from inside the sandbox; its default is Infinity. (3.11.0) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.0)
- Support for the TypeScript compiler was added. (3.10.0) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.10.0)

### Behavior and default changes

- Bun compile, esbuild, pkg, and other single-file bundlers can now ship vm2 because sandbox bootstrap files are embedded in generated lib/sources.js instead of read from disk at runtime. (3.12.2) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.12.2)

### Fixes and other changes

- The sandbox Proxy install is wrapped in try/catch so JavaScriptCore throwing on the sealed slot no longer aborts sandbox setup before the first run(). (3.12.0) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.12.0)
- Fixes the .node extension handler key so native addon resolution no longer silently falls through to the default path. (3.11.5) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.5)
- Restores underlying-value output when inspecting sandbox results on Node 26+, instead of rendering nested Proxy wrappers. (3.11.5) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.5)
- Restores array iteration methods on frozen host arrays used inside the sandbox. (3.11.5) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.11.5)
- Allows Object.setPrototypeOf on sandbox-local objects. (3.10.5) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.10.5)
- Promise handlers use Reflect.apply instead of .call(). (3.10.2) — [release notes](https://github.com/patriksimek/vm2/releases/tag/v3.10.2)