vm2 3.11.7 patches six sandbox escape vulnerabilities affecting Node.js

The vm2 library, version 3.11.7, released on October 1, 2026, patches six critical sandbox escape vulnerabilities. These flaws allowed untrusted JavaScript code running within a Node.js sandbox to bypass security boundaries and access host system modules. The vulnerabilities stemmed from mismatches between policy enforcement rules and the Node.js runtime's actual module resolution behavior. Attackers could exploit these issues to execute arbitrary code, modify files, or intercept secure communications on the host machine. The fixes address problems in built-in module filtering, promise prototype handling, and package name allowlist matching.