CVE-2026-47683

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.6

Description An issue exists where the bufferAllocLimit enforcement in lib/setup-sandbox.js is bypassed. While this limit is intended to cap host-side Buffer allocations driven by sandbox code to prevent Denial of Service (DoS), it does not cover Buffer.concat(list, totalLength) or Buffer.from(arrayLike) when an attacker-controlled length is provided. This allows sandbox code to perform large synchronous host external-memory allocations that bypass the configured cap, potentially exhausting the host process memory and leading to an Out-of-Memory (OOM) crash. This is particularly impactful in environments with strict memory limits, such as Docker containers, Kubernetes pods, or AWS Lambda, where a small payload can trigger a significant increase in Resident Set Size (RSS).

Recommendations Update vm2 to version 3.11.6. As a temporary workaround, restrict the use of Buffer.concat() and Buffer.from() within the sandbox environment until the update is applied.