Vulnerabilities
vm2 allows a sandboxed plugin to execute native code through `node:sqlite` (Critical severity, CVE-2026-92938)
A critical-severity advisory for the npm package vm2 is fixed in version 3.11.7.
npm
Vulnerabilities
piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env (Critical severity, CVE-2026-102992)
A critical-severity advisory for the npm package piscina is fixed in version 5.3.2.