CVE-2026-92935
vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE
The NodeVM constructor computes hasRealRequireConfig using typeof requireOpts === 'object' && requireOpts !== null, so require: [] bypasses the guard intended to reject nesting without an explicit require configuration. makeResolverFromLegacyOptions() then destructures the array to undefined option fields and returns a resolver containing only NESTING_OVERRIDE.vm2.
- No known exploitation
- Severity
- Critical, CVSS 9.0 (v3.1)
- EPSS
- 0.67% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- vm2 (npm) >= 3.11.4, <= 3.11.6, fixed in 3.11.7 · GHSA-8hr7-r645-pc6w