How many CVEs have a located fix in patriksimek/vm2?

51 published CVEs have a fix traced to functions in patriksimek/vm2, touching 72 functions across 18 files.

Which function in patriksimek/vm2 has been patched by the most CVEs?

createBridge in lib/bridge.js has been changed by 16 CVE fixes, from 2023 to 2026.

How large is a typical CVE fix in patriksimek/vm2?

The median fix changes 69 lines. 20% of fixes change 20 lines or fewer, and 31% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

javascript

typescript

#80 of 500 repositories

patriksimek/vm2

Name: patriksimek/vm2: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix September 27, 2026

51

CVE fixes located

Published CVEs

72

Functions patched

Distinct function sites

18

Files patched

Distinct source files

2021–2026

Years covered

By CVE publication date

Overview

51 published CVEs have a fix traced to functions in patriksimek/vm2, the earliest published in 2021. Those fixes changed 72 distinct functions across 18 files, in 413 patch hunks.

Among the 500 repositories tracked here, patriksimek/vm2 ranks #80 by the number of CVEs with a located fix.

Most patched functions

Functions in patriksimek/vm2 changed by the most CVE fixes.

Most patched files

Files in patriksimek/vm2 changed by the most CVE fixes.

1lib/setup-sandbox.js25 CVEs · 22 functions
2lib/bridge.js18 CVEs · 12 functions
3lib/resolver-compat.js7 CVEs · 11 functions
4lib/builtin.js7 CVEs · 5 functions
5lib/nodevm.js3 CVEs · 2 functions
6lib/transformer.js3 CVEs · 2 functions
7lib/vm.js3 CVEs · 2 functions
8lib/contextify.js2 CVEs · 3 functions
9lib/main.js2 CVEs · 3 functions
10lib/compiler.js2 CVEs · 2 functions

Fix size

How much code a CVE fix in patriksimek/vm2 changes, with backports counted once.

69

Median lines changed

Added plus removed, per CVE

20%

Fixes of 20 lines or fewer

Share of CVE fixes

31%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in patriksimek/vm2, and the functions each fix changed.

vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool
CVE-2026-100723createBridge isArrayBufferOrShared bufferFrom
Medium · CVSS 6.9
EPSS 0.3%2026-09-27
vm2 before 3.12.2 Host Process Termination via Construct Trap
CVE-2026-100722createBridge
High · CVSS 8.9
EPSS 0.3%2026-09-27
vm2 before 3.12.2 Authorization Bypass via Custom Resolver
CVE-2026-100721LegacyResolver isCustomResolved isPathWithin
Critical · CVSS 9.5
EPSS 0.4%2026-09-27
vm2 before 3.11.8 allowAsync Bypass via Promise Thenable
CVE-2026-92959makeAsyncGuardedResolve localPromise
High · CVSS 7.1
EPSS 0.4%2026-09-17
vm2 before 3.11.7 Denylist Bypass via fs/promises
CVE-2026-92958addDefaultBuiltin makeBuiltinsFromLegacyOptions
High · CVSS 8.4
EPSS 0.4%2026-09-17
vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefix
CVE-2026-92957makeBuiltinsFromLegacyOptions
Critical · CVSS 9.4
EPSS 0.5%2026-09-17
vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming
CVE-2026-92956
Critical · CVSS 10.0
EPSS 0.6%2026-09-17
vm2 before 3.11.8 Sandbox Escape via NodeVM
CVE-2026-92955createBridge isDangerousHostProtoReader
Critical · CVSS 10.0
EPSS 0.7%2026-09-17
vm2 3.10.0 through 3.11.5 Denial of Service via Host Promise
CVE-2026-92954hostPromiseBenignNoop createBridge
Critical · CVSS 9.2
EPSS 0.5%2026-09-17
vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray
CVE-2026-92953createBridge
Critical · CVSS 9.3
EPSS 0.5%2026-09-17
vm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering Bypass
CVE-2026-92952isDangerousCrossRealmSymbol isDangerousSymbol
High · CVSS 8.9
EPSS 0.5%2026-09-17
vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver
CVE-2026-92951LegacyResolver constructor
Critical · CVSS 9.4
EPSS 0.5%2026-09-17

Get an alert for each new patriksimek/vm2 CVE, with the patched functions and AI-written analysis.

Monitor vm2 CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

dataease/dataease51 CVEs fusionpbx/fusionpbx51 CVEs debian/qemu52 CVEs py-pdf/pypdf52 CVEs wordpress/wordpress52 CVEs froxlor/froxlor53 CVEs grokability/snipe-it53 CVEs gogs/gogs54 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in patriksimek/vm2.

How many CVEs have a located fix in patriksimek/vm2?: 51 published CVEs have a fix traced to functions in patriksimek/vm2, touching 72 functions across 18 files.
Which function in patriksimek/vm2 has been patched by the most CVEs?: createBridge in lib/bridge.js has been changed by 16 CVE fixes, from 2023 to 2026.
How large is a typical CVE fix in patriksimek/vm2?: The median fix changes 69 lines. 20% of fixes change 20 lines or fewer, and 31% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track patriksimek/vm2 CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing