RHSA-2026:72722

vm2 is an open source vm/sandbox for Node.js.

vm2 before 3.11.7 (affected versions <= 3.11.6) does not enforce the VM({ timeout }) option on code executed outside the synchronous VM#run() call.

js-yaml is a JavaScript YAML parser and dumper.

urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features.

vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM.

### Summary `qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member.

vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM.

adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size.

vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors, allowing attackers to allocate arbitrary host memory.

js-yaml is a JavaScript YAML parser and dumper.

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.

compression is a Node.js and Express compression middleware.

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested.

isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing…

multer is a Node.js middleware for handling multipart/form-data uploads.