CVE-2026-92941: vm2 NodeVM Vulnerability Allows Host Process TLS Trust Store Manipulation
Summary
CVE-2026-92941: vm2 NodeVM can replace the host process TLS trust store. Affects vm2 versions >= 3.11.3, < 3.11.7. Fixed in 3.11.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
vm2 is a popular Node.js library that provides a sandboxed environment for executing untrusted code. It allows developers to run JavaScript code in a secure manner, isolating it from the host environment. However, a critical vulnerability has been identified in version 3.11.6, which exposes the host TLS module to the sandbox, potentially allowing malicious code to manipulate the host's TLS trust settings.
Vulnerability Detail
The vulnerability arises from the exposure of the host 'tls' module to a NodeVM when explicitly allowed. Although the module is wrapped as read-only, its functions still operate on the host's process-wide state. Specifically, the 'tls.setDefaultCACertificates()' function can be exploited to replace the certificate authorities trusted by subsequent host TLS clients. This breach allows an attacker to make host HTTPS clients trust an attacker-controlled CA, leading to credential theft and response tampering. The vulnerability is particularly dangerous as it can disrupt unrelated host TLS traffic and compromise sensitive data.
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.11.7
This is the first release that contains the fix.
npm install vm2@3.11.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid allowing the 'tls' and 'url' builtins in your NodeVM configuration. This will prevent the execution of potentially harmful functions that can manipulate the TLS trust store.
Conclusion
The vm2 vulnerability (CVE-2026-92941) poses a significant risk to applications using the affected versions of the package. By exposing the host TLS module, it allows malicious code to manipulate trust settings, leading to potential data breaches. It is crucial to update to the patched version and consider workarounds to mitigate risks.
See every vulnerability recorded for vm2 →
FAQ
The CVSS score of this vulnerability is 10.0, indicating a critical severity level.
Versions of vm2 up to and including 3.11.6 are affected. Version 3.11.7 and later contain the fix.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading your package-lock.json file, you can check for vulnerabilities without needing to access the code.
An attacker can replace the CAs used by host-side HTTPS clients, intercept sensitive data, and disrupt TLS connections, leading to significant security risks.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
