CVE-2026-44009: Critical RCE in vm2 Node.js Sandbox

The impact of this RCE vulnerability is severe. A successful exploit allows an attacker to gain complete control over the Node.js process and potentially the underlying system. This could involve stealing sensitive data, installing malware, or using the compromised system as a launchpad for further attacks. The sandbox environment is intended to isolate untrusted code; this vulnerability completely undermines that protection, granting attackers unrestricted access. Given the widespread use of Node.js in various applications, the potential blast radius is significant.

1. Gereserveerd2026-05-04
2. Gepubliceerd2026-05-13

The primary mitigation for CVE-2026-44009 is to immediately upgrade to vm2 version 3.11.2 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing stricter input validation and sanitization within your Node.js application to limit the potential impact of malicious code. While a WAF or proxy cannot directly prevent this vulnerability, they can help detect and block suspicious requests attempting to exploit it. After upgrading, verify the fix by attempting to execute a known malicious payload within the vm2 sandbox; it should be properly contained and not result in code execution.