CVE-2026-92957: vm2 Package NodeVM Builtin Deny Bypass Vulnerability
Summary
CVE-2026-92957: vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process. Affects vm2 versions < 3.11.7. Fixed in 3.11.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vm2 package is a popular Node.js library that provides a virtual machine environment for executing untrusted code securely. It allows developers to run JavaScript code in a sandboxed environment, isolating it from the host system. This is particularly useful for applications that require executing user-generated code while minimizing security risks. However, a vulnerability has been identified in the NodeVM configuration, which can lead to unauthorized access to sensitive built-in modules.
Vulnerability Detail
The vulnerability arises from the way NodeVM handles node:-prefixed built-in specifiers during the require() resolution process. Specifically, while it normalizes these specifiers, it fails to properly handle user-defined negative entries in wildcard policies. This oversight allows sandboxed code to require both child_process and node:child_process, thereby exposing the host's process-spawning APIs. The root cause lies in the mismatch between how built-in names are checked against allowed and denied lists, leading to potential command execution capabilities from untrusted code.
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.11.7
This is the first release that contains the fix.
npm install vm2@3.11.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using node:-prefixed built-in specifiers in your NodeVM configuration. Instead, explicitly deny the canonical names of built-ins you wish to restrict. For example:
new NodeVM({
require: {
builtin: ['*', '-child_process']
}
});
Conclusion
The vm2 package has a critical vulnerability that allows unauthorized access to built-in modules due to improper handling of node:-prefixed specifiers. It is crucial for developers using this package to update to the patched version or implement workarounds to secure their applications against potential exploits.
See every vulnerability recorded for vm2 →
FAQ
The vulnerability has a CVSS score of 9.9, indicating a critical level of severity.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The vulnerability allows sandboxed code to access sensitive host modules, potentially leading to unauthorized command execution capabilities.
Yes, a patch is available in version 3.11.7 of the vm2 package. It is recommended to update to this version to mitigate the vulnerability.
If an immediate update is not possible, implement the suggested workaround by denying the canonical names of built-ins instead of using node:-prefixed specifiers.
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
