CVE-2026-47139
High · 8.6CVSS
8.6
EPSS
0.5%
Published
Jun 12, 2026
CISA due date
—
The record
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM supports excluding public network builtins from the wildcard builtin option. With this configuration direct access to http, https, http2, net, dgram, tls, dns, and dns/promises is blocked. However, Node.js also exposes underscored internal HTTP builtins such as _http_client and _http_server. These are not blocked when the public modules are excluded. Sandboxed code can use these internal builtins to make outbound HTTP requests and open listening HTTP sockets even though the public network modules are denied. This issue has been patched in version 3.11.4.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | vm2 | 0 | 3.11.4 |
Related vulnerabilities
- GHSA-r9pm-gxmw-wv6p NodeVM network builtin exclusions bypass via internal _http_client and _http_server Same vulnerability
- CVE-2026-47210 vm2 is an open source vm/sandbox for Node.js. Also affects vm2
- CVE-2026-47209 vm2 is an open source vm/sandbox for Node.js. Also affects vm2
- CVE-2026-47208 vm2 is an open source vm/sandbox for Node.js. Also affects vm2
- CVE-2026-47135 vm2 is an open source vm/sandbox for Node.js. Also affects vm2
- CVE-2026-47137 vm2 is an open source vm/sandbox for Node.js. Also affects vm2
- CVE-2026-47141 vm2 is an open source vm/sandbox for Node.js. Also affects vm2
- CVE-2026-47140 vm2 is an open source vm/sandbox for Node.js. Also affects vm2