CVE-2026-93604: Javascript Sandbox Crypto Sanitizer Missing Setfips Neutralizationcve-2026-93604-javascript-sandbox-crypto-sanitizer-missing-setfips-neutralization
This sanitizer builds a shallow copy of the host Node.js crypto module and neutralizes the process-wide mutator crypto.setEngine, but returns the copy without also neutralizing crypto.setFips. The read-only/sandbox wrapper used to expose the copy blocks property replacement but not the side effect of a forwarded host call, so untrusted sandbox code can still
