Detections
Analytics
CVE-2026-43999
critical
Description
A vulnerability in the vm2 Node.js library that allows a bypass of NodeVM's built-in allowlist and enables an attacker to load excluded builtins like child_process and achieve remote code execution. (Affects version 3.10.5, patched in 3.11.0)
References
https://thehackernews.com/2026/05/vm2-nodejs-library-vulnerabilities.html