CVE-2026-92957
vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process
NodeVM normalizes node:-prefixed builtin specifiers during require() resolution, but it does not normalize user-provided negative builtin entries in wildcard policy.
- No known exploitation
- Severity
- Critical, CVSS 9.9 (v3.1)
- EPSS
- 0.54% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- vm2 (npm) <= 3.11.6, fixed in 3.11.7 · GHSA-8686-vhfx-7r3j