vm2 before 3.11.7 Timeout Bypass via FinalizationRegistry

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-92942 · CVE overview and exploitation status

EUVD-2026-81592

GHSA-vjcv-9j33-wj62

GHSA-r4fx-v8hh-22mv

cve-program · CVE-2026-92942

• https://github.com/patriksimek/vm2/security/advisories/GHSA-r4fx-v8hh-22mv
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-timeout-bypass-via-finalizationregistry

euvd · EUVD-2026-81592

• https://github.com/patriksimek/vm2/security/advisories/GHSA-r4fx-v8hh-22mv
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-timeout-bypass-via-finalizationregistry

nvd · CVE-2026-92942

• https://github.com/patriksimek/vm2/security/advisories/GHSA-r4fx-v8hh-22mv
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-timeout-bypass-via-finalizationregistry

osv · GHSA-r4fx-v8hh-22mv

• https://github.com/patriksimek/vm2/security/advisories/GHSA-r4fx-v8hh-22mv
• https://nvd.nist.gov/vuln/detail/CVE-2026-92942
• https://github.com/patriksimek/vm2/commit/fe2fcca2a1e693548993eccc624489dc4cb586b4
• https://github.com/patriksimek/vm2
• https://github.com/patriksimek/vm2/releases/tag/v3.11.7
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-timeout-bypass-via-finalizationregistry

osv · GHSA-vjcv-9j33-wj62

• https://github.com/patriksimek/vm2/security/advisories/GHSA-r4fx-v8hh-22mv
• https://nvd.nist.gov/vuln/detail/CVE-2026-92942
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-timeout-bypass-via-finalizationregistry

• vm2 before 3.11.7 (affected versions <= 3.11.6) does not enforce the VM({ timeout }) option on code executed outside the synchronous VM#run() call. The timeout only wraps the single call to _runScript() via doWithTimeout() in lib/vm.js, and… · Advisory content revised · 1 Nov 2026