p PatchFirst

CVE-2026-92941

CVE-2026-92941 · vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation

This page contains facts from public vulnerability sources. Check the original advisory before updating.

vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates() and replace process-wide certificate authorities. Attackers with access to allowed tls and url builtins can use URLSearchParams to create host-realm arrays and manipulate the TLS trust store, enabling subsequent host HTTPS clients to accept attacker-controlled certificates.

CVSS 10.0 · Critical · EPSS 0.3% · Public exploit · Fix available

Published
Updated

Stack: node

Affected products and versions

  • vm2

    Versions
    • ≥ 3.11.3, < 3.11.7: Affected (semver)
    • 3.11.7: Not affected (semver)

    Update to 3.11.7

  • vm2 npm

    Affected ranges
    • SEMVER: ≥ 3.11.3, < 3.11.7

    Update to 3.11.7

Original sources

Check your server →