CVE-2026-93604 is a high severity (CVSS 7.2) access control flaw in the vm2 npm package through 3.12.0. If an embedder allowlists the crypto builtin for a NodeVM, guest code can call crypto.setFips and change the FIPS mode of the whole host process. The fix is vm2 3.12.1.
What's affected
The vm2 advisory lists versions up to and including 3.12.0 as affected and 3.12.1 as patched. The weakness is CWE-284, improper access control.
The flaw applies only when the embedding application explicitly allows the crypto builtin through the NodeVM require option. Without that configuration the guest cannot reach the function. The cause is in the builtin sanitizer: it replaces crypto.setEngine but leaves crypto.setFips callable, and the read only wrapper around the host module does not contain side effects of forwarded host functions.
One note on sources. The advisory header gives the affected range as 3.12.0 and earlier, while its summary text refers to vm2 3.11.8 as the version tested. Use the header range, and treat everything up to 3.12.0 as affected.
How to check if you're exposed
Find vm2 in your tree, including indirect uses.
npm ls vm2
npm explain vm2
Then search your own code for NodeVM options that allow builtins.
grep -rn "builtin" --include=*.js --include=*.ts src | grep -i crypto
If crypto is not in the allowed builtins for any NodeVM, this CVE does not reach your code, though you should still plan the upgrade. If it is, treat the instance as affected.
What to do now
- Upgrade vm2 to 3.12.1 or later, including copies pulled in by other packages. Use your package manager's override feature if a dependency pins an older copy.
- Remove crypto from the allowed builtins for any NodeVM where guest code does not need it.
- Move to a stronger isolation model for untrusted code if you can, such as a separate process or container with its own limits, rather than relying on an in process sandbox alone.
- Check whether anything in your host process reads FIPS mode and relies on it, since guest code could have changed it.
- Paste your lockfile or manifest into the free in-browser dependency scan to see whether the affected package is in your tree, then use reachability analysis to separate code paths you call from ones you never touch.
Why it matters
The pattern behind this CVE is common in sandboxes. The sandbox passes a host object to untrusted code and wraps it so properties cannot be replaced, but a function on that object still acts on the real process. A wrapper that blocks assignment does not block side effects. CWE-284 fits because a process wide security setting is reachable from code that should not control it.
The impact is rated high but not critical, because it requires an unusual configuration and changes a setting rather than running host code. The record does not mark the issue as exploited, and it is not in CISA's catalog. Reachability analysis helps here, since the same package can be harmless in one service and risky in another.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Am I affected if I use vm2 without the crypto builtin?
Not by this CVE. It needs the embedder to allowlist crypto for a NodeVM. Upgrade anyway so you are not carrying an old sandbox.
What is the fixed version?
vm2 3.12.1, per the advisory.
Sources
Last reviewed: 18 October 2026.
