vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit Bypass

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-92961 · CVE overview and exploitation status

EUVD-2026-81611

GHSA-3m4j-9x2m-pq7h

GHSA-v836-6xw4-9cx3

cve-program · CVE-2026-92961

• https://github.com/patriksimek/vm2/security/advisories/GHSA-v836-6xw4-9cx3
• https://www.vulncheck.com/advisories/vm2-before-3.11.6-memory-exhaustion-dos-via-bufferalloclimit-bypass

euvd · EUVD-2026-81611

• https://github.com/patriksimek/vm2/security/advisories/GHSA-v836-6xw4-9cx3
• https://www.vulncheck.com/advisories/vm2-before-3.11.6-memory-exhaustion-dos-via-bufferalloclimit-bypass

nvd · CVE-2026-92961

• https://github.com/patriksimek/vm2/security/advisories/GHSA-v836-6xw4-9cx3
• https://www.vulncheck.com/advisories/vm2-before-3.11.6-memory-exhaustion-dos-via-bufferalloclimit-bypass

osv · GHSA-v836-6xw4-9cx3

• https://github.com/patriksimek/vm2/security/advisories/GHSA-v836-6xw4-9cx3
• https://github.com/patriksimek/vm2
• https://github.com/patriksimek/vm2/releases/tag/3.11.6

• vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors, allowing attackers to allocate arbitrary host memory. Attackers can bypass the buffer allocation cap by using these V8 intri… · Advisory content revised · 1 Nov 2026