AIKIDO-2026-394007
vm2 is vulnerable to Denial of Service
75
High Risk
This Affects:
vm2TL;DR
The timeout option only bounds synchronous execution wrapped by the VM run method, while FinalizationRegistry and WeakRef are exposed to the sandbox unmodified. Sandboxed code registers a FinalizationRegistry cleanup callback and drops its target so garbage collection invokes the callback outside timeout enforcement. The callback runs an unbounded busy loop that freezes the Node.js event loop despite the configured timeout. The fix brings finalization callbacks under timeout control or removes the constructors from the sandbox.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you rely on the timeout option to bound untrusted code.
Background info
vm2 is vulnerable to Denial of Service in versions 0.0.1 - 3.11.6.
How to fix this
Upgrade the vm2 library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant