vm2 3.11.3 through 3.11.6 are affected by CVE-2026-92941; vm2 3.11.7 fixes it. The described attack requires a NodeVM that allows both the tls and url builtins, plus a Node.js runtime with tls.setDefaultCACertificates(). It can replace the host thread’s default certificate authorities for later TLS connections that do not provide their own CA list. Upgrade affected installations to vm2 3.11.7 or later and review the release notes.
Which vm2 versions are affected?
The vm2 maintainer advisory identifies versions 3.11.3 through 3.11.6 inclusive as affected, and 3.11.7 as patched. The vm2 3.11.7 release notes list the trust-store issue among the security fixes.
As an Amazon Associate I earn from qualifying purchases.
GitLab Advisory Database rates CVE-2026-92941 10.0 (Critical), CVSS v3.1. That is the database’s published severity rating, not a measure of how many installations are affected or evidence of exploitation in the wild. The vm2 advisory displays the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L. See the GitLab Advisory Database entry.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What does CVE-2026-92941 do?
The issue lets sandboxed NodeVM code change the default certificate-authority list used by the host Node.js thread for subsequent TLS connections. The vm2 maintainer explains that tls is exposed through a read-only wrapper, but that does not make calls to its functions sandbox-local: tls.setDefaultCACertificates() changes the thread’s default trust list.
#1 Best Overall
The reported path also uses the host url builtin. In the advisory’s explanation, URLSearchParams.getAll() returns a host-realm array, and the vm2 bridge unwraps that array when it is passed back to the TLS function. The native API therefore receives the host array it requires. The advisory says this path does not need fs, process, module, child_process, an external package, or a wildcard builtin grant.
The maintainer characterizes the result as crossing the intended sandbox boundary. The demonstrated capability is process-wide TLS trust manipulation—not, by itself, arbitrary file access or shell-command execution.
What are the exploit preconditions?
The described route applies only when the configuration and runtime line up:
- The installed vm2 version is 3.11.3, 3.11.4, 3.11.5, or 3.11.6.
- The NodeVM explicitly allows both the
tlsandurlbuiltins. - The Node.js runtime provides
tls.setDefaultCACertificates(). The maintainer advisory reports this API in Node.js 22.19.0 and later in the 22.x line, and Node.js 24.5.0 and later in the 24.x line. Check the actual deployed runtime; not every Node.js release provides it.
These are the conditions for the described exploit path, not a reason to leave an affected vm2 version installed. The maintainer’s recommended fix is to upgrade.
What can an attacker affect?
After replacing the default CA list, sandboxed code can affect later host TLS clients that rely on that default. If an attacker can also influence a later request’s destination or network path—for example through DNS, routing, or a proxy—the host may accept a certificate signed by an attacker. That can expose credentials or let the attacker modify responses. Replacing the defaults can also remove ordinary trust roots and cause unrelated TLS connections to fail.
The scope has important limits. According to the maintainer advisory, connections that explicitly pass their own ca option are not affected by the changed default, and TLS sessions already cached may remain unchanged. The advisory’s local proof of concept creates a temporary CA and loopback HTTPS server: a host request fails certificate verification before sandbox execution, then succeeds after the sandbox changes the default trust list. It makes no external request and does not itself steal credentials.
How do you fix it?
- Find the deployed dependency. Check the application’s lockfile and installed dependency tree for vm2, including transitive dependencies, and identify the version actually deployed.
- Upgrade affected installations. Move vm2 3.11.3–3.11.6 to 3.11.7 or later, then rebuild and redeploy the application so the running environment uses the patched version.
- Review the NodeVM builtin allowlist. Confirm whether the application grants
tlsandurl. Avoid exposing process-wide mutators to untrusted code; a read-only wrapper is not a substitute for denying access to them. - Check the release notes and validate application behavior. The 3.11.7 release describes itself as a patch release without API changes, but lists observable behavior changes and upgrade notes, including CLI and builtin deny-token changes. Review the release notes for effects on your use of vm2.
Removing one or both builtins may remove the preconditions for this particular path, but the maintainer identifies upgrading as the fix; the advisory does not establish an alternate mitigation as equivalent.
Quick Recap
Best Value
What should teams verify after upgrading?
- The deployed dependency resolves to vm2 3.11.7 or later, not only a newer version declared in a manifest.
- The application’s NodeVM configuration grants only the builtins its sandboxed workloads need.
- Tests cover the application’s expected sandbox behavior and any CLI or builtin deny-token configuration affected by the release notes.
- Host TLS clients that need a specific trust set configure it explicitly where appropriate, rather than relying on a mutable process-wide default.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
