CVE-2026-44009

High

High exploit probability or critical severity with a known exploit.

CVSS base

9.8 CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS — probability of exploitation (30 days)

0.8%

55.4th percentile

CISA KEV

Not listed

Weakness / dates

CWE-653

Published 2026-05-13 · modified 2026-09-07

Description

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, This vulnerability is fixed in 3.11.2.

Affected

vm2_project

References

Official: NVD · CVE.org