vm2 versions 3.11.4 through 3.11.6 fail to fully filter Node.js registered internal symbols across the sandbox boundary. The filtering mechanisms in lib/setup-sandbox.js and lib/bridge.js omit certain symbols (nodejs.stream.disturbed and nodejs.stream.errored) present on newer Node.js releases such as v25.8.0. When a host WebStream object and the host stream/web module are exposed to the sandbox, sandbox code can retrieve these real host symbols via Object.getOwnPropertySymbols and use them as write keys on host stream objects. This corrupts host-visible stream state, for example causing stream.Readable.isDisturbed() to incorrectly return false for an already-consumed stream. This bypasses host logic that depends on Node's public stream-state helpers to enforce stream consumption rules and error handling. The vulnerability does not directly allow host code execution. This is an incomplete fix of a previous symbol filtering issue and is resolved in vm2 3.11.7.

The vulnerability allows sandboxed code to corrupt host stream state by manipulating internal Node.js stream symbols that were not filtered. This can bypass host logic enforcing one-shot body consumption, error rejection, and stream safety checks. Although it does not enable direct host code execution, it undermines the integrity of stream handling in the host environment, potentially leading to unexpected behavior or security bypasses in applications relying on these stream-state helpers.

Upgrade vm2 to version 3.11.7 or later, where this issue is fixed. Versions 3.11.4 through 3.11.6 are affected. No other mitigations are indicated by the vendor advisory.