CVE-2026-92958: Javascript Vm2 Builtin Denylist Exact Name Subpath Bypasscve-2026-92958-javascript-vm2-builtin-denylist-exact-name-subpath-bypass
Incomplete builtin denylist: the '*' wildcard expansion allow-gates each builtin with an exact-name deny test only (`-name` / `-node:name`). Node lists families and subpaths as separate builtinModules entries (`fs` vs `fs/promises`, `path` vs `path/posix`, `stream` vs `stream/web`), so a family token such as `-fs` removes only `fs` and leaves the real host `
