vm2@3.11.7
Skip this version — install 3.12.2 instead.
Followed by 3.11.8 within 70 h — likely a hotfix.
Why this verdict
- Followed by 3.11.8 within 70 h — likely a hotfix.Evidence
- 10 known advisories (worst: critical), fixed in 3.12.2.Evidence
Confidence 100% · algorithm v1 · computed 2026-10-23. How verdicts work
Supply chain and security
- Malware reports
- None known (OSV)
- Known advisories
- 10 known
- License
- MIT
- Install scripts
- None
- Build provenance
- Signed provenance
- Weekly downloads
- 4,715
- GHSA-2v2p-6j97-cjg9vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process
- GHSA-3vgf-8m4q-q4qrvm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix
- GHSA-489w-w794-jq94vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary
- GHSA-5h3f-q97h-ccvcvm2: NodeVM custom resolution bypasses external path boundaries
- GHSA-88hf-g992-jg85vm2: Sandbox Escape (NodeVM)
- GHSA-f8gf-w286-fmq2vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM
- GHSA-gjq8-xm47-88rcvm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process
- GHSA-pq68-rvw4-xp4rvm2 contains a sandbox escape vulnerability
- GHSA-r273-hxvj-fxhpvm2: util.getCallSites() bypasses GHSA-v27g-jcqj-v8rw host-frame redaction, leaks host call stack
- GHSA-x965-fc75-jpqhvm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit
Compatibility
No compatibility boundary is crossed: this is a patch or minor release on a stable major.
Check the official release notes below for behaviour changes before merging.
Release notes
Read the package page on npm for this version’s features and fixes.
Deprecations and deadlines
The maintainer has not deprecated this version on npm.