CVE-2026-92940
vm2 exposes host HTTPS credentials and TLS traffic through globalAgent
vm2 3.11.6 exposes the host process's real https.globalAgent when a NodeVM is explicitly allowed to require https. The module is wrapped as read-only, but calls to methods on the shared agent still mutate the host object. Sandbox code can register a free listener and receive host request options and the host TLS socket whenever an unrelated host HTTPS request releases a pooled connection.
- No known exploitation
- Severity
- Critical, CVSS 10.0 (v3.1)
- EPSS
- 0.47% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- vm2 (npm) >= 3.11.3, <= 3.11.6, fixed in 3.11.7 · GHSA-h85j-hv3c-qfgq