vm2: NodeVM network builtin exclusions bypass via internal _http_client and _http_server

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-47139 · Microsoft / collected KEV context

EUVD-2026-36444

GHSA-r9pm-gxmw-wv6p

cve-program · CVE-2026-47139

• https://github.com/patriksimek/vm2/security/advisories/GHSA-r9pm-gxmw-wv6p
• https://github.com/patriksimek/vm2/commit/436053e30eecbabd487e2fd2959c137ac34e2bb1
• https://github.com/patriksimek/vm2/releases/tag/v3.11.4

euvd · EUVD-2026-36444

• https://github.com/patriksimek/vm2/security/advisories/GHSA-r9pm-gxmw-wv6p
• https://github.com/patriksimek/vm2/commit/436053e30eecbabd487e2fd2959c137ac34e2bb1
• https://github.com/patriksimek/vm2/releases/tag/v3.11.4

nvd · CVE-2026-47139

• https://github.com/patriksimek/vm2/commit/436053e30eecbabd487e2fd2959c137ac34e2bb1
• https://github.com/patriksimek/vm2/releases/tag/v3.11.4
• https://github.com/patriksimek/vm2/security/advisories/GHSA-r9pm-gxmw-wv6p

osv · GHSA-r9pm-gxmw-wv6p

• https://github.com/patriksimek/vm2/security/advisories/GHSA-r9pm-gxmw-wv6p
• https://nvd.nist.gov/vuln/detail/CVE-2026-47139
• https://github.com/patriksimek/vm2/commit/436053e30eecbabd487e2fd2959c137ac34e2bb1
• https://github.com/patriksimek/vm2
• https://github.com/patriksimek/vm2/releases/tag/v3.11.4

No related operational record is retained in the current change model.