v3.11.6

Five advisories closed. Patch release — no API changes for valid configurations.

What's Changed

Security fixes

• GHSA-cfcw-xp6x-25gj — Stacked-indirection bypass of the GHSA-v6mx-mf47-r5wg apply-trap peel. Two layers of Function.prototype.{call,apply,bind} pushed the host prototype mutator out of the inspected position; a later variant ran the __proto__ setter entirely host-side, defeating both identity checks (RCE).
• GHSA-gmc2-2x9w-cgh9 — bufferAllocLimit bypass via Buffer.concat(list, totalLength) and Buffer.from(arrayLike), which reach the host allocator without traversing the sandbox-side wrapper — one call allocates past a configured cap (host memory-exhaustion DoS).
• GHSA-m283-3h24-438v — Host errors leaked live host references into sandbox catch blocks via Error.cause, the SuppressedError / AggregateError slots, arbitrary own properties (err.detail = process), and the carrier's prototype chain. Any embedder function throwing an error that carried a host reference was an escape (RCE).
• GHSA-m5w8-4gq2-6f8x — NodeVM builtin: ['*'] exposed os and dns, the last two process-wide builtins. Both leak host identity and network topology, and both write host state: dns.setServers() hijacks the host's DNS resolver, os.setPriority() renices the host process.
• GHSA-v836-6xw4-9cx3 — bufferAllocLimit bypass via ArrayBuffer, SharedArrayBuffer, every TypedArray constructor, and WebAssembly.Memory, which hit the same timeout-immune V8 allocator uncapped — a ~200-byte payload becomes gigabytes of host RSS (host memory-exhaustion DoS).

Upgrade Notes

• builtin: ['*'] users depending on os or dns — both are now denied, along with node:os, node:dns and dns/promises. Re-introduce a safe subset via require.mock / require.override.
• Finite bufferAllocLimit users — the cap now also covers Buffer.concat / from / copyBytesFrom and the ArrayBuffer / SharedArrayBuffer / TypedArray / WebAssembly.Memory constructors. The default Infinity is unaffected.
• Host errors now reach sandbox catch blocks as sandbox-realm errors. Primitive diagnostics are preserved and instanceof now works for subclasses; non-primitive properties and the host prototype chain are gone by design.

Full Changelog: v3.11.5...3.11.6