Node.js security incidents and patch status · pwned.coffee

Skip to content

0 spills in 2025 for Node.js

Not a single spill. Remarkable.

Each square is a day. Tap one to see what spilled. Heat = critical 4, high 3, medium 2, low 1, update half.

Past orders

criticalpatched 1 Oct 2026 vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector vm2 (npm) ## Reporter - Name or handle: `[YMsora]` - Report date: 2026-08-14 ## Summary The latest published vm2 release, **3.11.5**, and the current `main` branch are vulnerable to a sandbox escape when used on Node.js 26. An ordinary fulfilled Promise created by an async function can retain an attacker-controlled `constructor[Symbol.species]` across… fixed in vm2 3.11.7CVE-2026-929445 sources

Follow Node.js

RSS: /feed.xml?stack=node. JSON: /incidents.json?stack=node. Or add it to your usual for delivery.