A high-severity denial of service vulnerability in the vm2 sandbox library allows unauthenticated attackers to crash the host Node.js process by triggering unhandled promise rejections.

This vulnerability is a result of improper handling of rejected Promises returned from the host realm into the sandbox. An unauthenticated attacker can exploit this flaw by invoking host functions that return rejected Promises and ignoring the result, which triggers Node.js default behavior to terminate the entire host process.

The exploitation of this vulnerability results in an immediate denial of service for any application relying on the vm2 sandbox to execute untrusted JavaScript. Given the CVSS score of 8.6, this represents a significant availability risk that could lead to widespread service disruption, potential data loss during unexpected crashes, and operational downtime for critical business systems.

Immediate Action: Update the vm2 library to version 3.11.8 or later to incorporate the necessary promise rejection handling logic.

Proactive Monitoring: Monitor application logs for Node.js process termination events or unexpected "unhandled rejection" errors that correlate with sandboxed code execution.

Compensating Controls: If immediate patching is not possible, implement strict input validation and resource limiting for all code executed within the sandbox to reduce the attack surface.

Public Exploit Available: No

Organizations using vm2 must prioritize upgrading to version 3.11.8 immediately to eliminate this critical availability risk. Because the vulnerability allows for trivial process termination from an unauthenticated context, patching should be treated as a high-priority maintenance task to ensure system stability and availability.