vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, the bufferAllocLimit enforcement in lib/setup-sandbox.js does not cover Buffer.concat(list, totalLength) or Buffer.from(arrayLike) with an attacker-controlled length, allowing sandbox code to perform large synchronous host external-memory allocations that bypass the configured cap and can exhaust the host process. This issue is fixed in version 3.11.6.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, the bufferAllocLimit enforcement in
    lib/setup-sandbox.js does not cover Buffer.concat(list, totalLength) or Buffer.from(arrayLike) with an
    attacker-controlled length, allowing sandbox code to perform large synchronous host external-memory
    allocations that bypass the configured cap and can exhaust the host process. This issue is fixed in
    version 3.11.6. (CVE-2026-47683)

ID	Name	Product	Family	Type	Severity
457899	Echo: vm2: security update to 3.11.0+echo.2	Tenable Cloud Security	Echo Local Security Checks	Local	high
457899	Echo: vm2: security update to 3.11.0+echo.2	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
446008	SCA: security update for vm2 (GHSA-gmc2-2x9w-cgh9)	Tenable Cloud Security	SCA Checks	Local	high
446008	SCA: security update for vm2 (GHSA-gmc2-2x9w-cgh9)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-47683

high

Tenable Plugins

high

high

high

high