CVE-2026-47683: vm2 Buffer Allocation Limit Bypass Vulnerability
Summary
CVE-2026-47683: vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike. Affects vm2 versions < 3.11.6. Fixed in 3.11.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vm2 is a popular Node.js package that provides a sandboxed environment for executing untrusted code securely. It allows developers to run code in a controlled manner, limiting access to the host environment. However, a recent vulnerability has been identified that allows attackers to bypass the buffer allocation limit, potentially leading to Denial of Service (DoS) attacks.
Vulnerability Detail
The vulnerability arises from the bufferAllocLimit feature introduced in version 3.11.0, which is intended to cap host-side Buffer allocations driven by sandbox code. However, the methods Buffer.concat(list, totalLength) and Buffer.from(arrayLike) with a fake length are not capped, allowing attackers to allocate arbitrary amounts of memory. This can lead to significant memory consumption and potentially crash the host process, especially in environments with strict memory limits like Docker or AWS Lambda. The vulnerability is classified as high severity with a CVSS score of 8.7.
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.11.6
This is the first release that contains the fix.
npm install vm2@3.11.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using Buffer.concat and Buffer.from with array-like objects that have a numeric length in your sandboxed code until you can update to the patched version. Instead, use alternative methods for buffer allocation that respect the bufferAllocLimit.
Conclusion
The vm2 package has a significant vulnerability that allows attackers to bypass buffer allocation limits, leading to potential Denial of Service attacks. It is crucial to update to version 3.11.6 or later to mitigate this risk. Additionally, using tools like Vulert can help monitor and manage vulnerabilities in your applications effectively.
See every vulnerability recorded for vm2 →
FAQ
The vulnerability allows untrusted sandbox code to allocate excessive amounts of memory, potentially leading to Denial of Service (DoS) by exhausting system resources.
You can use Vulert to monitor your application for vulnerabilities. By analyzing your package-lock.json file, Vulert can alert you to any open-source vulnerabilities in real-time.
Environments with strict memory limits, such as Docker containers, Kubernetes pods, and serverless platforms like AWS Lambda, are particularly vulnerable to this issue.
While the best solution is to update to the patched version, you can temporarily avoid using the vulnerable methods in your sandboxed code as a workaround.
The CVSS score for this vulnerability is 8.7, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
