HIGH GitHub
CVE-2026-47683
vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike
## Summary
vm2 bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike
The `bufferAllocLimit` option introduced in 3.11.0 (GHSA-6785-pvv7-mvg7) caps host-side Buffer allocations driven by sandbox code, the way embedders opt into `timeout`. The cap wraps `Buffer.alloc`, `Buffer.allocUnsafe`, `Buffer.allocUnsafeSlow`, and the deprecated `Buffer(N)` / `new Buffer(N)` forms. Two other API paths reach the same host C++ allocator with an attacker-controlled size and are not capped:
Affected Products
- npm/vm2 <= 3.11.5
References
- https://github.com/advisories/GHSA-gmc2-2x9w-cgh9
- https://github.com/patriksimek/vm2/security/advisories/GHSA-gmc2-2x9w-cgh9
- https://github.com/patriksimek/vm2/releases/tag/3.11.6
- https://github.com/advisories/GHSA-gmc2-2x9w-cgh9
This high severity vulnerability was published on 2026-08-17 via GitHub. Affected: npm/vm2 <= 3.11.5.
vulnfeed aggregates 11030 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.