vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefix

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-92957 · CVE overview and exploitation status

EUVD-2026-81606

GHSA-28q4-xrqh-9479

GHSA-8686-vhfx-7r3j

cve-program · CVE-2026-92957

• https://github.com/patriksimek/vm2/security/advisories/GHSA-8686-vhfx-7r3j
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-authentication-bypass-via-node-prefix

euvd · EUVD-2026-81606

• https://github.com/patriksimek/vm2/security/advisories/GHSA-8686-vhfx-7r3j
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-authentication-bypass-via-node-prefix

nvd · CVE-2026-92957

• https://github.com/patriksimek/vm2/security/advisories/GHSA-8686-vhfx-7r3j
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-authentication-bypass-via-node-prefix

osv · GHSA-28q4-xrqh-9479

• https://github.com/patriksimek/vm2/security/advisories/GHSA-8686-vhfx-7r3j
• https://nvd.nist.gov/vuln/detail/CVE-2026-92957
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-authentication-bypass-via-node-prefix

osv · GHSA-8686-vhfx-7r3j

• https://github.com/patriksimek/vm2/security/advisories/GHSA-8686-vhfx-7r3j
• https://nvd.nist.gov/vuln/detail/CVE-2026-92957
• https://github.com/patriksimek/vm2/commit/b0f50662dd499ff33544bb42387958c64711af1e
• https://github.com/patriksimek/vm2
• https://github.com/patriksimek/vm2/releases/tag/v3.11.7
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-authentication-bypass-via-node-prefix

• vm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating user-supplied negative (deny) entries in a NodeVM wildcard require policy. Although NodeVM strips the `node:` prefix during require() resolution, nega… · Advisory content revised · 1 Nov 2026