Claude-assisted vm2 hardening rejected only one literal option pair. Other values still built a resolver that exposed vm2 inside the sandbox, letting untrusted code create a nested NodeVM with access to host modules.

+		// SECURITY (GHSA-8hg8-63c5-gwmx): `nesting: true` injects a NESTING_OVERRIDE+		// builtin that exposes `vm2` to the sandbox regardless of `require: false`.+		// The sandbox then constructs an inner NodeVM with attacker-chosen `require`+		// config (unconstrained by the outer config — by design of nesting) and+		// reaches `child_process` for full host RCE. The contradictory option pair+		// is the specific trap the advisory describes; reject it at construction+		// with a clear error rather than silently producing an unsandboxed config.

+				+ '`require(\'vm2\')` and construct nested VMs unconstrained by the outer '+				+ 'config — which contradicts `require: false`. To deny all requires, '+				+ 'remove `nesting: true`. To allow nested VMs, replace `require: false` '+				+ 'with an explicit config (e.g. `require: { builtin: [] }`) so the '+				+ 'tradeoff is visible. See README "`nesting: true` is an escape hatch". '+				+ 'Context: GHSA-8hg8-63c5-gwmx.'+			);+		} 		const { 			compiler, 			eval: allowEval,

-		// `nesting: true` injects a NESTING_OVERRIDE builtin that exposes `vm2` to-		// the sandbox. When `requireOpts` is also falsy, `makeResolverFromLegacyOptions`-		// hits its `if (!options)` branch and builds a resolver whose ONLY builtin-		// is `vm2` — a pure escape primitive (sandbox does `require('vm2')`, builds-		// an inner NodeVM with attacker-chosen `require` config, reaches-		// `child_process` for host RCE).+		// A truthy `nesting` injects a NESTING_OVERRIDE builtin that exposes+		// `vm2` to the sandbox. When `requireOpts` is not a real require-config+		// object, `makeResolverFromLegacyOptions` produces a resolver whose ONLY+		// builtin is `vm2` — a pure escape primitive (sandbox does+		// `require('vm2')`, builds an inner NodeVM with attacker-chosen+		// `require` config, reaches `child_process` for host RCE). 		//-		// The check must run *after* destructuring and against `requireOpts`, not-		// against the raw `options.require`, because the destructuring default-		// (`require: requireOpts = false`) collapses every falsy/omitted path to-		// the same insecure resolver:-		//   - `require: false`           → requireOpts = false   (GHSA-8hg8 PoC)-		//   - `require` omitted          → requireOpts = false   (GHSA-m4wx PoC)-		//   - `require: undefined`       → requireOpts = false   (default kicks in)-		//   - `require: null` / `0` / '' → requireOpts is null/0/''-		// All of them hit `if (!options)` in makeResolverFromLegacyOptions and-		// produce the NESTING_OVERRIDE-only resolver. Use `!requireOpts` to reject-		// every shape that yields that resolver; the documented escape hatch-		// (`nesting: true` + an explicit `require` config object, even `{}`)-		// continues to work — the developer's intent is then visible.-		if (nesting === true && !requireOpts) {+		// The guard mirrors the actual reachability of that insecure resolver+		// on two axes:+		//+		// 1. `nesting` truthiness, not strict `=== true`. The override is gated+		//    a few lines below by `nesting && NESTING_OVERRIDE`, which fires for+		//    ANY truthy value (`1`, `'yes'`, `{}`, `[]`, etc.). The check must+		//    cover every truthy `nesting` value the override gate accepts.+		//+		// 2. `requireOpts` must be an actual require-config object (or a+		//    `Resolver` instance), not just "truthy". `makeResolverFromLegacyOptions`+		//    destructures every primitive/function value to all-`undefined` and+		//    falls into the same NESTING_OVERRIDE-only `if (!options)` branch as+		//    falsy values do. The shapes that collapse to the insecure resolver:+		//      - `require: false` / `undefined` / `null` / `0` / `''`+		//          → falsy → `if (!options)` branch+		//      - `require: true` / `1` / `'yes'` / `Symbol()` / `function(){}`+		//          → truthy non-object → destructured to all-undefined →+		//             `makeBuiltinsFromLegacyOptions(undefined, …, override)` →+		//             same NESTING_OVERRIDE-only resolver+		//    The documented escape hatch (a truthy `nesting` + an explicit+		//    `require` config object, even `{}`) continues to work — a non-null+		//    object counts as the developer's deliberate acknowledgment of the

+				'NodeVM `nesting` requires an explicit `require` config object. '+				+ '`nesting` is an escape hatch that exposes `vm2` to the ' 				+ 'sandbox (sandbox code can `require(\'vm2\')` and construct nested '-				+ 'VMs unconstrained by the outer config). With `require` falsy or '-				+ 'omitted, the resolver exposes ONLY `vm2` — a pure escape primitive. '-				+ 'To deny all requires, remove `nesting: true`. To allow nested VMs, '-				+ 'pass an explicit `require` config (e.g. `require: { builtin: [] }`) '-				+ 'so the tradeoff is visible. See README "`nesting: true` is an escape '-				+ 'hatch". Context: GHSA-m4wx-m65x-ghrr (supersedes GHSA-8hg8-63c5-gwmx).'+				+ 'VMs unconstrained by the outer config). With `require` set to '+				+ 'anything other than a config object (`false`, omitted, `true`, '+				+ 'a number, a string, a function), the resolver exposes ONLY '+				+ '`vm2` — a pure escape primitive. To deny all requires, remove '+				+ '`nesting`. To allow nested VMs, pass an explicit `require` '+				+ 'config (e.g. `require: { builtin: [] }`) so the tradeoff is '+				+ 'visible. See README "`nesting: true` is an escape hatch". '+				+ 'Context: GHSA-m4wx-m65x-ghrr (supersedes GHSA-8hg8-63c5-gwmx).' 			); 		}