CVE-2026-47141

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.4

Description NodeVM exposes process-wide observability builtins when they are permitted via require.builtin. Specifically, the diagnostics channel, async hooks, and perf hooks modules are not included in the dangerous builtin denylist. Because these modules operate on a process-wide level rather than being sandbox-local, sandboxed code can use them to observe host application data across the vm2 boundary. This can lead to the exposure of sensitive host process state, such as HTTP request headers (including Authorization or session tokens) via diagnostics channel, host AsyncResource data via async hooks.executionAsyncResource(), and host performance timeline entries via perf hooks.performance.getEntriesByType('mark').

Recommendations Update to version 3.11.4. As a temporary workaround, restrict the use of diagnostics channel, async hooks, and perf hooks builtins within the sandbox configuration.