High severityGHSA Advisory· Published Aug 17, 2026· Updated Sep 9, 2026

CVE-2026-47683

Description

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, the bufferAllocLimit enforcement in lib/setup-sandbox.js does not cover Buffer.concat(list, totalLength) or Buffer.from(arrayLike) with an attacker-controlled length, allowing sandbox code to perform large synchronous host external-memory allocations that bypass the configured cap and can exhaust the host process. This issue is fixed in version 3.11.6.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
vm2npm	< 3.11.6	3.11.6

Affected products

Patriksimek/Vm2GHSA
Range: <= 3.11.5

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-gmc2-2x9w-cgh9ghsaADVISORY
github.com/patriksimek/vm2/releases/tag/3.11.6nvdWEB
github.com/patriksimek/vm2/security/advisories/GHSA-gmc2-2x9w-cgh9nvdWEB
github.com/patriksimek/vm2/commit/3ffb315512e634cf85c447375e85d6c83d00a4bdnvd

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000