NodeVM network builtin exclusions bypass via internal _http_client and _http_server
Date: 2026-05
Affected: npm/vm2
Attack vector: ssrf
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-47139
CWE: CWE-693
CVSS: 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)

## Summary `NodeVM` supports excluding public network builtins from the wildcard builtin option. With this configuration direct access to `http`, `https`, `http2`, `net`, `dgram`, `tls`, `dns`, and `dns/promises` is blocked. However, Node.js also exposes underscored internal HTTP builtins such as `_http_client` and `_http_server`. These are not blocked when the public modules are excluded. Sandboxed code can use these internal builtins to make outbound HTTP requests and open listening HTTP sockets even though the public network modules are denied. **Note**: This is not host RCE. It is a network capability bypass that can lead to SSRF-style access to internal services. ## Details The wildcard builtin expansion is based on Node.js builtin module names: ```js const BUILTIN_MODULES = (nmod.builtinModules || Object.getOwnPropertyNames(process.binding('natives'))) .filter(s=>!s.startsWith('internal/') && !DANGEROUS_BUILTINS.has(s)); ``` Public modules can be excluded with `-name`: ```js if (builtins.indexOf(`-${name}`) === -1) { addDefaultBuiltin(res, name, hostRequire); } ``` But excluding `http` and `net` does not exclude internal siblings such as: ```text _http_client _http_server _tls_wrap ``` These internal modules expose network primitives. Confirmed examples: 1. `require('_http_client').ClientRequest(...)` performs an outbound HTTP request to a host-local service while `http` and `net` are blocked. 2. `require('_http_server').Server(...).listen(...)` opens


Mitigations:

Architectural layers (MAESTRO):