CVE-2026-47683
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
vm2 prior to version 3.11.6 has a vulnerability where the bufferAllocLimit enforcement does not cover Buffer.concat(list, totalLength) or Buffer.from(arrayLike) with an attacker-controlled length, allowing sandbox code to perform large synchronous host external-memory allocations that bypass the configured cap and can exhaust the host process.
Risk Assessment
Code running in the sandbox could cause memory exhaustion of the host process, potentially leading to service crash or denial of service.
Recommendation
Upgrade vm2 to version 3.11.6, which contains the fix.
Original NVD description (English source)
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, the bufferAllocLimit enforcement in lib/setup-sandbox.js does not cover Buffer.concat(list, totalLength) or Buffer.from(arrayLike) with an attacker-controlled length, allowing sandbox code to perform large synchronous host external-memory allocations that bypass the configured cap and can exhaust the host process. This issue is fixed in version 3.11.6.