Critical severity10.0NVD Advisory· Published Sep 17, 2026· Updated Sep 17, 2026
CVE-2026-92947
CVE-2026-92947
Description
vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive data exposure and potential denial-of-service.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
vm2npm | < 3.11.7 | 3.11.7 |
Affected products
1- Range: <3.11.7
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-fcqc-726x-5wfcghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-92947ghsaADVISORY
- github.com/patriksimek/vm2/commit/4f2508abeb252aa86eb6761c78b3b000248fb089ghsaWEB
- github.com/patriksimek/vm2/releases/tag/v3.11.7ghsaWEB
- github.com/patriksimek/vm2/security/advisories/GHSA-fcqc-726x-5wfcnvdWEB
- www.vulncheck.com/advisories/vm2-before-3.11.7-memory-disclosure-via-buffer-poolnvdWEB
News mentions
1- vm2 npm Package: 25 Critical Sandbox Escape Vulnerabilities Disclosed TogetherVypr Intelligence · Sep 18, 2026