CVE-2026-47137

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the fix for GHSA-8hg8-63c5-gwmx (CVE-2023-37903) introduced a check in nodevm.js line 263 that blocks the combination nesting: true + require: false. However, the check uses strict equality (options.require === false), which is trivially bypassed by omitting the require option entirely. When require is not specified, options.require is undefined, not false. The strict equality check fails, so the security guard is skipped. Immediately after (line 280), the destructuring default require: requireOpts = false assigns requireOpts = false, producing the exact configuration the patch was designed to prevent. This issue has been patched in version 3.11.4.

• CWE-913

• https://github.com/advisories/GHSA-g644-9gfx-q4q4
• https://github.com/patriksimek/vm2/commit/01a7552add345d5a6862623884e6b79a85bf0568
• https://github.com/patriksimek/vm2/commit/86ab819f202c3a8dad88cef5705f2e416c5188d7
• https://github.com/patriksimek/vm2/releases/tag/v3.11.4
• https://github.com/patriksimek/vm2/security/advisories/GHSA-m4wx-m65x-ghrr

Published

Jun 12, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-47130NextCRM is open-source customer relationship management (CRM…7.1
• CVE-2026-47131vm2 is an open source vm/sandbox for Node.js. Prior to versi…10
• CVE-2026-47133ClearanceKit intercepts file-system access events on macOS a…6.9
• CVE-2026-47134ClearanceKit intercepts file-system access events on macOS a…6.9
• CVE-2026-47135vm2 is an open source vm/sandbox for Node.js. Prior to versi…8.7
• CVE-2026-47136RustFS is a distributed object storage system built in Rust.…6.9
• CVE-2026-47138Parse Server is an open source backend that can be deployed …8.7
• CVE-2026-47139vm2 is an open source vm/sandbox for Node.js. Prior to versi…8.6
• CVE-2026-4714Incorrect boundary conditions in the Audio/Video component. …7.5
• CVE-2026-47140vm2 is an open source vm/sandbox for Node.js. Prior to versi…10
• CVE-2026-47141vm2 is an open source vm/sandbox for Node.js. Prior to versi…6.9
• CVE-2026-47143Capstone is a disassembly framework. Versions prior to 6.0.0…5.9