vm2 before 3.11.7 Timeout Bypass via FinalizationRegistry

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-92942 · Microsoft / collected KEV context

EUVD-2026-81592

GHSA-vjcv-9j33-wj62

GHSA-r4fx-v8hh-22mv

cve-program · CVE-2026-92942

• https://github.com/patriksimek/vm2/security/advisories/GHSA-r4fx-v8hh-22mv
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-timeout-bypass-via-finalizationregistry

euvd · EUVD-2026-81592

• https://github.com/patriksimek/vm2/security/advisories/GHSA-r4fx-v8hh-22mv
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-timeout-bypass-via-finalizationregistry

nvd · CVE-2026-92942

• https://github.com/patriksimek/vm2/security/advisories/GHSA-r4fx-v8hh-22mv
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-timeout-bypass-via-finalizationregistry

osv · GHSA-r4fx-v8hh-22mv

• https://github.com/patriksimek/vm2/security/advisories/GHSA-r4fx-v8hh-22mv
• https://nvd.nist.gov/vuln/detail/CVE-2026-92942
• https://github.com/patriksimek/vm2/commit/fe2fcca2a1e693548993eccc624489dc4cb586b4
• https://github.com/patriksimek/vm2
• https://github.com/patriksimek/vm2/releases/tag/v3.11.7
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-timeout-bypass-via-finalizationregistry

osv · GHSA-vjcv-9j33-wj62

• https://github.com/patriksimek/vm2/security/advisories/GHSA-r4fx-v8hh-22mv
• https://nvd.nist.gov/vuln/detail/CVE-2026-92942
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-timeout-bypass-via-finalizationregistry

• vm2 before 3.11.7 (affected versions <= 3.11.6) does not enforce the VM({ timeout }) option on code executed outside the synchronous VM#run() call. The timeout only wraps the single call to _runScript() via doWithTimeout() in lib/vm.js, and… · Advisory content revised · 1 Nov 2026