CVE-2026-92940: vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgent
vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed code when a NodeVM is explicitly configured to allow require('https'). The builtin loader wraps host modules in a read-only proxy, but method calls such as Agent.prototype.on() are forwarded to the underlying host object, so sandbox code can register a listener for the agent's 'free' event. When an unrelated host HTTPS request releases a pooled connection, the listener receives the live host request options and the host TLSSocket, allowing sandboxed code to read the host's Authorization header and private destination host/port, attach a data listener to the released socket and read subsequent host response bodies in plaintext, and issue attacker-chosen authenticated requests using the stolen credentials. The issue is fixed in 3.11.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vm2to a version that resolves this vulnerability.Fixed in 3.11.7
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using vm2 versions 3.11.3 through 3.11.6 are exposed only when a NodeVM is explicitly configured to permit require('https'). The affected sandbox can then access behavior of the host process's shared https.globalAgent.
What must an attacker be able to do to exploit it?
An attacker needs to execute code inside an affected NodeVM where the https builtin has been allowed. Exploitation also depends on the host process making HTTPS requests that use the pooled global agent, so a released connection can trigger the sandbox-registered listener.
What could an attacker obtain or do after exploitation?
Sandboxed code can obtain live host request options and a host TLS socket, including Authorization headers and private destination host and port information. It can read subsequent HTTPS response bodies in plaintext and send attacker-chosen authenticated requests with stolen credentials.
What should be done if upgrading cannot happen immediately?
Do not allow require('https') in NodeVM configurations until the affected vm2 version can be replaced. This removes the explicitly required condition that exposes the host HTTPS global agent.
How can I determine whether I am affected?
Check whether vm2 is at version 3.11.3 through 3.11.6 and inspect NodeVM configuration for explicit permission to require the https builtin. Also identify whether the host process makes HTTPS requests using the shared global agent, particularly requests carrying Authorization credentials.