The patriksimek vm2 library versions up to 3.11.6 do not enforce the VM({ timeout }) option on code executed outside the synchronous VM#run() call. The timeout only applies to the single _runScript() invocation within VM#run(). Sandboxed code can register a FinalizationRegistry cleanup callback on an object and then drop the strong reference to that object. When the V8 garbage collector later reclaims the object, it invokes the cleanup callback outside the timeout context. If the callback contains a busy loop, it can block the host event loop indefinitely, causing denial of service. The timing of the callback invocation depends on garbage collection triggers such as memory pressure or explicit GC calls.

This vulnerability allows sandboxed code to bypass the VM timeout restriction by executing code asynchronously during garbage collection cleanup callbacks. This can result in unbounded CPU consumption and denial of service by blocking the host event loop. The impact is a high-severity denial of service condition affecting applications using vulnerable vm2 versions.

A fix is available in vm2 version 3.11.7 that addresses this issue. Users should upgrade to version 3.11.7 or later to ensure the VM timeout option is properly enforced on all code execution paths, including FinalizationRegistry cleanup callbacks. Until upgraded, applications remain vulnerable to denial of service via this uncontrolled resource consumption.