FlowiseAI/Flowise · error · Error

NodeVM Execution Error: ${e}

Error message

NodeVM Execution Error: ${e}

What it means

Outer catch-all wrapping exceptions from the NodeVM (vm2) branch of executeJavascript. It catches vm.run failures (sandboxed code threw, syntax error, disallowed require, timeout), parseOutput failures, or streamOutput errors — rewrapping as 'NodeVM Execution Error: <e>'.

Source

Thrown at packages/components/src/utils.ts:1809

        const vm = new NodeVM(finalNodeVMOptions)

        try {
            const response = await vm.run(`module.exports = async function() {${code}}()`, __dirname)

            let finalOutput = response

            // Stream output if streaming function provided
            if (streamOutput && finalOutput) {
                let streamOutputString = finalOutput
                if (typeof response === 'object') {
                    streamOutputString = JSON.stringify(finalOutput, null, 2)
                }
                streamOutput(streamOutputString)
            }

            return parseOutput(finalOutput)
        } catch (e) {
            throw new Error(`NodeVM Execution Error: ${e}`)
        }
    }
}

/**
 * Create a standard sandbox object for code execution
 * @param {string} input - The input string
 * @param {ICommonObject} variables - Variables from getVars
 * @param {ICommonObject} flow - Flow object with chatflowId, sessionId, etc.
 * @param {ICommonObject} additionalSandbox - Additional sandbox variables
 * @returns {ICommonObject} - The sandbox object
 */
export const createCodeExecutionSandbox = (
    input: string,
    variables: IVariable[],
    flow: ICommonObject,
    additionalSandbox: ICommonObject = {}
): ICommonObject => {

View on GitHub (pinned to abe4a8601a)

Solutions

  1. Read <e> in the message — vm2 surfaces 'Access denied to require ...' or timeout specifics.
  2. Add the needed module to TOOL_FUNCTION_EXTERNAL_DEP (external) or set ALLOW_BUILTIN_DEP=true (built-ins).
  3. Increase the timeoutMs for the tool node if the workload legitimately needs more time.
  4. Make the custom function return JSON-serializable data (plain objects/arrays/primitives).

Example fix

// before
} catch (e) {
  throw new Error(`NodeVM Execution Error: ${e}`)
}

// after — classify vm2 denial vs timeout vs user error
} catch (e) {
  const msg = e instanceof Error ? e.message : String(e)
  if (/Access denied to require/.test(msg)) {
    throw new Error(`NodeVM: disallowed module. Add it to TOOL_FUNCTION_EXTERNAL_DEP or enable ALLOW_BUILTIN_DEP. Detail: ${msg}`)
  }
  if (/timeout/i.test(msg)) {
    throw new Error(`NodeVM: execution timed out. Increase the node timeoutMs. Detail: ${msg}`)
  }
  throw new Error(`NodeVM Execution Error: ${msg}`, { cause: e })
}
Defensive patterns

Strategy: try-catch

Validate before calling

function assertDepsAllowed(imports: string[], env: NodeJS.ProcessEnv) {
  const external = (env.TOOL_FUNCTION_EXTERNAL_DEP || '').split(',').filter(Boolean)
  const missing = imports.filter((m) => !external.includes(m))
  if (missing.length) throw new Error(`Disallowed modules: ${missing.join(', ')}`)
}

Type guard

function isVm2AccessDenied(e: unknown): boolean {
  return e instanceof Error && /Access denied to require/i.test(e.message)
}

Try / catch

} catch (e) {
  const msg = e instanceof Error ? e.message : String(e)
  if (/Access denied to require/.test(msg)) {
    throw new Error(`Disallowed module. Update TOOL_FUNCTION_EXTERNAL_DEP or set ALLOW_BUILTIN_DEP=true. Detail: ${msg}`)
  }
  throw new Error(`NodeVM Execution Error: ${msg}`, { cause: e })
}

Prevention

When it happens

Trigger: User code references a require('fs') that isn't in builtinDeps; code imports an external module not in the deps allow-list; vm2 timeout exceeded (timeoutMs); code throws a non-serializable value; parseOutput chokes on a Symbol/function return value.

Common situations: ALLOW_BUILTIN_DEP not set to 'true' so built-in modules are blocked; TOOL_FUNCTION_EXTERNAL_DEP missing the package the custom tool needs; vm2 timeout too low for the workload; returned value is undefined or a function which JSON.stringify can't handle.

Related errors

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/44509904b49b83af. Report an issue: GitHub.