vm2: bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-47683 · Microsoft / collected KEV context

EUVD-2026-60461

GHSA-gmc2-2x9w-cgh9

cve-program · CVE-2026-47683

• https://github.com/patriksimek/vm2/security/advisories/GHSA-gmc2-2x9w-cgh9
• https://github.com/patriksimek/vm2/commit/3ffb315512e634cf85c447375e85d6c83d00a4bd
• https://github.com/patriksimek/vm2/releases/tag/3.11.6

euvd · EUVD-2026-60461

• https://github.com/patriksimek/vm2/security/advisories/GHSA-gmc2-2x9w-cgh9
• https://github.com/patriksimek/vm2/commit/3ffb315512e634cf85c447375e85d6c83d00a4bd
• https://github.com/patriksimek/vm2/releases/tag/3.11.6

nvd · CVE-2026-47683

• https://github.com/patriksimek/vm2/commit/3ffb315512e634cf85c447375e85d6c83d00a4bd
• https://github.com/patriksimek/vm2/releases/tag/3.11.6
• https://github.com/patriksimek/vm2/security/advisories/GHSA-gmc2-2x9w-cgh9

osv · GHSA-gmc2-2x9w-cgh9

• https://github.com/patriksimek/vm2/security/advisories/GHSA-gmc2-2x9w-cgh9
• https://github.com/patriksimek/vm2
• https://github.com/patriksimek/vm2/releases/tag/3.11.6

• vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, the bufferAllocLimit enforcement in lib/setup-sandbox.js does not cover Buffer.concat(list, totalLength) or Buffer.from(arrayLike) with an attacker-controlled length, allowing s… · Advisory content revised · 1 Nov 2026