p PatchFirst

CVE-2026-92947

CVE-2026-92947 · vm2 before 3.11.7 Memory Disclosure via Buffer Pool

This page contains facts from public vulnerability sources. Check the original advisory before updating.

vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive data exposure and potential denial-of-service.

CVSS 10.0 · Critical · EPSS 0.5% · Public exploit · Fix available

Published
Updated

Stack: node

Affected products and versions

  • vm2

    Versions
    • ≥ 0, < 3.11.7: Affected (semver)
    • 3.11.7: Not affected (semver)

    Update to 3.11.7

  • vm2 npm

    Affected ranges
    • SEMVER: < 3.11.7

    Update to 3.11.7

Original sources

Check your server →