Security Vulnerability in vm2 Sandbox for Node.js by Patrik Simek
CVE-2026-47683

8.7HIGH

Key Information:

Vendor

Patriksimek

Status
Vm2
Vendor
CVE Published:
17 August 2026

What is CVE-2026-47683?

A vulnerability exists in vm2, an open-source sandbox solution for Node.js, where prior to version 3.11.6, the bufferAllocLimit enforcement mechanism in lib/setup-sandbox.js fails to adequately cover certain buffer methods. Specifically, the methods Buffer.concat(list, totalLength) and Buffer.from(arrayLike) can be manipulated with attacker-controlled lengths, enabling malicious sandbox code to execute large synchronous external-memory allocations. This inadequacy can lead to exhaustion of the host process due to overwhelming resource use. The issue has been addressed in version 3.11.6.

Affected Version(s)

vm2 < 3.11.6

References

https://github.com/patriksimek/vm2/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/patriksimek/vm2/commit/3ffb315512e634c...
x_refsource_MISC
https://github.com/patriksimek/vm2/releases/tag/3.11.6
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.