vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive data exposure and potential denial-of-service.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory
    used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-
    realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive data exposure and
    potential denial-of-service. (CVE-2026-92947)

ID	Name	Product	Family	Type	Severity
473576	Echo: vm2: security update to 3.11.7	Tenable Cloud Security	Echo Local Security Checks	Local	critical
473576	Echo: vm2: security update to 3.11.7	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	critical
473033	SCA: security update for vm2 (GHSA-fcqc-726x-5wfc)	Tenable Cloud Security	SCA Checks	Local	critical
473033	SCA: security update for vm2 (GHSA-fcqc-726x-5wfc)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical

Detections

Analytics

CVE-2026-92947

critical

Tenable Plugins

critical

critical

critical

critical