The vulnerabilities of ArrayBuffer, SharedArrayBuffer, and TypedArray functions in the NPM package manager’s vm2 library allow attackers to compromise the accessibility of protected information.

The vulnerability of the ArrayBuffer, SharedArrayBuffer, and TypedArray functions in the vm2 package manager’s NPM library is related to the unlimited distribution of resources when processing the bufferAllocLimit parameter. Exploiting this vulnerability could allow an attacker to compromise the...

CVE-2026-92961

A flaw was found in vm2. This vulnerability allows an attacker to bypass the bufferAllocLimit enforcement on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors. By doing so, the attacker can allocate arbitrary host memory, leading to memory exhaustion and a Denial of Service DoS conditio...

CVE-2026-92961

vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors, allowing attackers to allocate arbitrary host memory. Attackers can bypass the buffer allocation cap by using these V8 intrinsics to exhaust host process memory and trigger...

CVE-2026-92961 vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit Bypass

vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors, allowing attackers to allocate arbitrary host memory. Attackers can bypass the buffer allocation cap by using these V8 intrinsics to exhaust host process memory and trigger...

CVE-2026-92961

vm2 before 3.11.6 fails to enforce its bufferAllocLimit cap on ArrayBuffer , SharedArrayBuffer , and TypedArray constructors. Attackers can exploit this by leveraging these V8 intrinsics to allocate arbitrary host process memory, bypassing the intended allocation ceiling and triggering an out-of-...

EUVD-2026-81611

vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors, allowing attackers to allocate arbitrary host memory. Attackers can bypass the buffer allocation cap by using these V8 intrinsics to exhaust host process memory and trigger...

CVE-2026-92961 vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit Bypass

vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors, allowing attackers to allocate arbitrary host memory. Attackers can bypass the buffer allocation cap by using these V8 intrinsics to exhaust host process memory and trigger...

CVE-2026-92961 vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit Bypass

vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors, allowing attackers to allocate arbitrary host memory. Attackers can bypass the buffer allocation cap by using these V8 intrinsics to exhaust host process memory and trigger...

CVE-2026-92961: Allocation of Resources Without Limits or Throttling

vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors, allowing attackers to allocate arbitrary host memory. Attackers can bypass the buffer allocation cap by using these V8 intrinsics to exhaust host process memory and trigger...

CVE-2026-47683 vm2: bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, the bufferAllocLimit enforcement in lib/setup-sandbox.js does not cover Buffer.concatlist, totalLength or Buffer.fromarrayLike with an attacker-controlled length, allowing sandbox code to perform large synchronous host external-memory...

CVE-2026-47683

In vm2

EUVD-2026-60461

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, the bufferAllocLimit enforcement in lib/setup-sandbox.js does not cover Buffer.concatlist, totalLength or Buffer.fromarrayLike with an attacker-controlled length, allowing sandbox code to perform large synchronous host external-memory...

GHSA-V836-6XW4-9CX3 vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass

Summary: The bufferAllocLimit defense GHSA-6785-pvv7-mvg7 can be completely bypassed using ArrayBuffer, SharedArrayBuffer, or any TypedArray constructor. These allocate identical host-process RSS through the same V8/libuv C++ allocation path as Buffer.alloc but are not subject to the size cap...

vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike

Summary vm2 bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike The bufferAllocLimit option introduced in 3.11.0 GHSA-6785-pvv7-mvg7 caps host-side Buffer allocations driven by sandbox code, the way embedders opt into timeout. The cap wraps Buffer.alloc, Buffer.allocUnsafe,...

CVE-2026-47683: Allocation of Resources Without Limits or Throttling

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, the bufferAllocLimit enforcement in lib/setup-sandbox.js does not cover Buffer.concatlist, totalLength or Buffer.fromarrayLike with an attacker-controlled length, allowing sandbox code to perform large synchronous host external-memory...