CVE-2026-100722

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.12.2

Description The software fails to apply host-side Promise rejection handling within the sandbox-to-host construct trap. In the BaseHandler component, the apply trap utilizes the markHostPromiseHandled() function to sanitize returned values, but the construct path returns the result of Reflect.construct() without this sanitization. If a constructable host function is exposed and its constructor returns a native rejected Promise, an untrusted script can invoke it using the new operator. This allows a rejected host Promise to remain unhandled, which Node.js treats as an uncaught exception, leading to the termination of the host process.

Recommendations Update vm2 to version 3.12.2 or later.