CVE-2026-47139

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM supports excluding public network builtins from the wildcard builtin option. With this configuration direct access to http, https, http2, net, dgram, tls, dns, and dns/promises is blocked. However, Node.js also exposes underscored internal HTTP builtins such as _http_client and _http_server. These are not blocked when the public modules are excluded. Sandboxed code can use these internal builtins to make outbound HTTP requests and open listening HTTP sockets even though the public network modules are denied. This issue has been patched in version 3.11.4.

• CWE-693

• https://github.com/patriksimek/vm2/commit/436053e30eecbabd487e2fd2959c137ac34e2bb1
• https://github.com/patriksimek/vm2/releases/tag/v3.11.4
• https://github.com/patriksimek/vm2/security/advisories/GHSA-r9pm-gxmw-wv6p
• https://github.com/patriksimek/vm2/security/advisories/GHSA-r9pm-gxmw-wv6p

Published

Jun 12, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-47133ClearanceKit intercepts file-system access events on macOS a…6.9
• CVE-2026-47134ClearanceKit intercepts file-system access events on macOS a…6.9
• CVE-2026-47135vm2 is an open source vm/sandbox for Node.js. Prior to versi…8.7
• CVE-2026-47136RustFS is a distributed object storage system built in Rust.…6.9
• CVE-2026-47137vm2 is an open source vm/sandbox for Node.js. Prior to versi…10
• CVE-2026-47138Parse Server is an open source backend that can be deployed …8.7
• CVE-2026-4714Incorrect boundary conditions in the Audio/Video component. …7.5
• CVE-2026-47140vm2 is an open source vm/sandbox for Node.js. Prior to versi…10
• CVE-2026-47141vm2 is an open source vm/sandbox for Node.js. Prior to versi…6.9
• CVE-2026-47143Capstone is a disassembly framework. Versions prior to 6.0.0…5.9
• CVE-2026-47144Shamefile is a linter for undocumented linter warnings. Prio…5.5
• CVE-2026-47145In EmberZNet v9.0.2 and earlier, malformed Color Control mes…6.5