10.0
Critical
CVE-2026-92947 vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by…
Description
vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive data exposure and potential denial-of-service.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| vm2 3.11 | earliest → < 3.11.7 | 3.11.7 |
References
- GitHub Security Advisory (GHSA-fcqc-726x-5wfc) github.com
- VulnCheck Advisory: vm2 before 3.11.7 Memory Disclosure via Buffer Pool www.vulncheck.com
Timeline
- Published
- Last modified
Other CVEs of vm2
The 77 CVEs of vm2 →
CVE-2026-100723
vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength…
6.9
Medium
CVE-2026-100722
vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap
8.9
High
CVE-2026-100721
vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver
9.5
Critical
CVE-2026-93606
vm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in `VM` and `NodeVM`
10.0
Critical