CVE-2026-47139: vm2 Sandbox Network Bypass via Internal HTTP Modules

Technical summary

NodeVM in vm2 allows administrators to restrict access to public network builtins via a wildcard exclusion mechanism. However, the implementation failed to account for Node.js internal modules prefixed with underscores—specifically _http_client, _http_server, and related DNS internals. These undocumented interfaces expose the same network capabilities as their public counterparts. A sandbox escape is possible because sandboxed code can require() these internal modules directly, circumventing the intended access control model. The vulnerability stems from an incomplete blocklist in CWE-693 (Protection Mechanism Failure), where the sandbox assumes all network-relevant exports are covered by the public API surface.

Business impact

Organizations using vm2 to execute third-party or user-supplied code in a trusted-network-only context are at risk. Attackers within the sandbox can exfiltrate data by making HTTP requests to external systems, establish reverse shells, scan internal networks, or participate in distributed attacks—actions that should have been impossible under the sandbox's network policy. This degrades the integrity of any security model that relies on vm2's isolation promises for threat containment.

Affected systems

vm2 versions before 3.11.4 are affected. The vulnerability only manifests when NodeVM is explicitly configured to block public network modules. Default installations that do not restrict network access are not vulnerable to this specific bypass. Organizations should inventory Node.js applications that use vm2 as a sandboxing layer, particularly in code evaluation, plugin execution, or untrusted script platforms.

Exploitability

Exploitation requires no authentication, network access, or user interaction—only the ability to execute code within a vm2 sandbox that has the vulnerable network policy in place. The attack is straightforward: sandboxed code simply requires an internal module like require('_http_client') and uses it to initiate network operations. The barrier to exploitation is low for any attacker who gains code execution within the sandbox context, making this a high-severity containment failure.

Remediation

Upgrade vm2 to version 3.11.4 or later. The patch blocks access to internal HTTP and DNS modules in the same manner as public equivalents. After patching, validate that your sandbox configuration matches your security intent and conduct regression testing to ensure legitimate sandbox use cases remain functional.

Patch guidance

Upgrade vm2 to version 3.11.4 or later. Verify the upgrade in your package-lock.json or yarn.lock file. No configuration changes are required post-patch; existing network policies will now correctly enforce the intended restrictions. Test any applications that depend on vm2 to confirm expected sandbox behavior is preserved.

Detection guidance

Monitor for unusual require() calls within sandboxed environments, particularly for modules starting with underscores (_http_client, _http_server, _http_common, dns/promises internals). Log all network outbound connections initiated from processes running vm2 sandboxes and correlate them with the sandbox's stated network policy. In Node.js debug logs, look for requires of internal modules that should have been blocked. Review vm2 security policy configurations to ensure network restrictions are intentional and documented.

Why prioritize this

This is a HIGH-severity sandbox escape that defeats explicit security controls. Organizations relying on vm2's network isolation guarantees should patch immediately. The vulnerability is trivial to exploit and has no known active exploitation in the wild yet, but the risk window is narrow given the straightforward nature of the bypass and potential for supply-chain attack scenarios where vm2 acts as a trust boundary for plugin or worker execution.

Risk score, explained

CVSS 3.1 score of 8.6 (HIGH) reflects network-adjacent attackability (AV:N), low complexity (AC:L), no privilege or user interaction (PR:N, UI:N), and changed scope (S:C). The impact is confidentiality (C:H) due to data exfiltration risk, with no direct availability impact. The score accurately captures the severity of a sandbox containment failure that undermines the trust model of applications built on vm2.

Frequently asked questions