https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T22:01:38.541905+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-47683 CVE-2026-47683 — vm2: bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike 2026-10-05T22:01:38.571946+00:00

Affected: patriksimek vm2

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, the bufferAllocLimit enforcement in lib/setup-sandbox.js does not cover Buffer.concat(list, totalLength) or Buffer.from(arrayLike) with an attacker-controlled length, allowing sandbox code to perform large synchronous host external-memory allocations that bypass the configured cap and can exhaust the host process. This issue is fixed in version 3.11.6.