CVE-2026-92941

vm2 (Node.js sandboxing library) versions 3.11.3 through 3.11.6 expose the host tls module to NodeVM sandbox code. An attacker with access to the allowed tls and url builtins can use URLSearchParams to construct host-realm arrays and invoke tls.setDefaultCACertificates() , replacing the process-w...