CVE-2026-92940: vm2 exposes host HTTPS credentials and TLS traffic through globalAgent

Should you act?

Critical and remotely reachable

No known exploitation yet, but it is network-reachable without credentials. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

• No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
• EPSS 0.5%, percentile 40: FIRST’s model estimates a 0.5% chance of exploitation activity in the next 30 days, higher than 40% of all scored CVEs (low). EPSS is a probability, not a verdict.
• Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
• Only applies if your dependency tree includes vm2 (npm) >= 3.11.3, <= 3.11.6, fixed in 3.11.7. Check your lockfile, including transitive dependencies.
• Editorial verdict: Check exposure. vm2: 22 Critical Sandbox Escapes, Fixed in 3.12.2 — If anything outside your trust boundary can get code into vm2, upgrade to 3.12.2 today and plan to move that code out of process; if vm2 only runs your own code, upgrade on a normal cycle.

What it is

vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed code when a NodeVM is explicitly configured to allow require('https'). The builtin loader wraps host modules in a read-only proxy, but method calls such as Agent.prototype.on() are forwarded to the underlying host object, so sandbox code can register a listener for the agent's 'free' event. When an unrelated host HTTPS request releases a pooled connection, the listener receives the live host request options and the host TLSSocket, allowing sandboxed code to read the host's Authorization header and private destination host/port, attach a data listener to the released socket and read subsequent host response bodies in plaintext, and issue attacker-chosen authenticated requests using the stolen credentials. The issue is fixed in 3.11.7.

From the GitHub advisory

Summary

vm2 3.11.6 exposes the host process's real https.globalAgent when a NodeVM is explicitly allowed to require https. The module is wrapped as read-only, but calls to methods on the shared agent still mutate the host object. Sandbox code can register a free listener and receive host request options and the host TLS socket whenever an unrelated host HTTPS request releases a pooled connection.

In a contained test, sandbox code allowed only the https builtin:

- read the host request's bearer token from the agent event; - attached a data listener to the released host TLS socket and read the next host response body in plaintext; - learned the private service host and port; - sent an attacker-chosen authenticated POST using the stolen host token; and - received confirmation that the service accepted the action.

The host application never passed its credentials, request, response, socket, or destination into the sandbox. They crossed the boundary solely because vm2 exposes the process-global HTTPS agent instead of a sandbox-local network module instance.

Weakness type: CWE-668.

Product: vm2 (npm) · Assigned by: VulnCheck · Published: 2026-09-17

Affected and fixed versions

Severity scores

• Attack vector: network (remotely reachable)
• Attack complexity: low
• Attack requirements: none
• Privileges required: none (no login)
• User interaction: none

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

• CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
• CISA SSVC assessment: exploitation none, automatable yes, technical impact partial.
• FIRST EPSS (model of 2026-10-21): 0.47% probability of exploitation activity in the next 30 days; percentile 40.

Timeline

• 2026-08-17 — erroneo.us brief: vm2: 22 Critical Sandbox Escapes, Fixed in 3.12.2
• 2026-09-17 — CVE record last updated
• 2026-09-17 — CVE record published by VulnCheck
• 2026-10-01 — GitHub-reviewed advisory GHSA-h85j-hv3c-qfgq published (critical)

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vendor and project advisories, patches

1. GitHub Security Advisory (GHSA-h85j-hv3c-qfgq) github.com

Vulnerability records

1. GitHub Advisory GHSA-h85j-hv3c-qfgq github.com
2. CVE.org record CVE-2026-92940 cve.org
3. NVD entry CVE-2026-92940 nvd.nist.gov

Other references from the CVE record and advisory

1. VulnCheck Advisory: vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgent vulncheck.com
2. github.com github.com
3. github.com github.com

Critical npm advisories · Today’s Security Digest