CVE-2026-47683

UNKNOWN 0.0

vm2: bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, the bufferAllocLimit enforcement in lib/setup-sandbox.js does not cover Buffer.concat(list, totalLength) or Buffer.from(arrayLike) with an attacker-controlled length, allowing sandbox code to perform large synchronous host external-memory allocations that bypass the configured cap and can exhaust the host process. This issue is fixed in version 3.11.6.

CWE	CWE-770
Vendor	patriksimek
Product	vm2
Published	Aug 17, 2026

Stay Ahead of the Next One

Get instant alerts for patriksimek vm2

Be the first to know when new unknown vulnerabilities affecting patriksimek vm2 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

patriksimek / vm2

< 3.11.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/patriksimek/vm2/security/advisories/GHSA-gmc2-2x9w-cgh9 github.com: https://github.com/patriksimek/vm2/commit/3ffb315512e634cf85c447375e85d6c83d00a4bd github.com: https://github.com/patriksimek/vm2/releases/tag/3.11.6