Which modules are whitelisted in cloud functions apart from node crypto lib?

Cloud Code tried to require 'ethereumjs-util' but this is not a whitelisted module.

Which modules are whitelisted (apart from integrated node crypto mentioned in docs)?
I want to see if I can verify a signed message using personal_sign from web3 in a cloud function.

The docs are up to date. The crypto module is the only one. Once the custom plugin feature is released it will be possible to write your own REST APIs in a Docker container and expose those as cloud functions. Keep your eye out for that in the not so distant future.