vm2 is acting less like a single bug and more like a broken containment boundary. The patch-for-one-CVE mindset fails here, because the disclosure has expanded into a cluster of sandbox escapes across older releases, and any reachable escape turns tenant-supplied JavaScript into host-level code execution inside the Node.js app.
The latest report lists a dozen critical flaws, including CVE-2026-24118, CVE-2026-24120, CVE-2026-24781, CVE-2026-26332, CVE-2026-26956, CVE-2026-43997, and others, affecting vm2 versions through 3.11.1. Maintainers have released vm2 3.11.2, which shifts this from a single-exploit notice to broad patching across multiple release lines.
For teams using vm2 to isolate untrusted code, the blast radius is the host application and whatever it can already reach: secrets, files, and network access. The practical risk is that older fixes did not close every escape hatch, so a partially patched deployment can still be one sandboxed script away from full compromise.