AIKIDO-2026-10723
vm2 is vulnerable to Denial of Service
86
High Risk
This Affects:
vm2TL;DR
Certain promise executor paths throw in a way that becomes an unhandled rejection on the host runtime. Embeddings without robust rejection handling can crash or destabilize the host process from guest-triggered edges. This is a host-process denial of service rather than a clean guest-contained error. vm2 reduces the synchronous executor surface; async rejection paths remain an operational concern for embedders.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
vm2 is vulnerable to Denial of Service in versions 0.0.1 - 3.10.5.
How to fix this
Upgrade the vm2 library to the patch version.
Links
GitHub Release
Other
access.redhat.com/errata/RHSA-2026:50850access.redhat.com/security/cve/CVE-2026-44001bugzilla.redhat.com/show_bug.cgi?id=2477208security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44001.json
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.