CVE-2026-47683 Overview
CVE-2026-47683 affects vm2, an open source virtual machine and sandbox library for Node.js. Versions prior to 3.11.6 fail to enforce the bufferAllocLimit control in lib/setup-sandbox.js when sandbox code invokes Buffer.concat(list, totalLength) or Buffer.from(arrayLike) with an attacker-controlled length. This gap lets sandbox code perform large synchronous host external-memory allocations that bypass the configured cap. An attacker with the ability to execute code inside the sandbox can exhaust the host Node.js process and cause denial of service. The maintainers fixed the issue in vm2 version 3.11.6.
Critical Impact
Sandboxed code can trigger unbounded native memory allocations, exhausting the host Node.js process and denying service to legitimate workloads.
Affected Products
- vm2 versions prior to 3.11.6
- Node.js applications embedding vm2 for untrusted code execution
- Multi-tenant services relying on vm2 sandbox isolation
Discovery Timeline
- 2026-08-17 - CVE-2026-47683 published to the National Vulnerability Database (NVD)
- 2026-08-18 - Last updated in NVD database
Technical Details for CVE-2026-47683
Vulnerability Analysis
vm2 exposes a bufferAllocLimit option intended to cap the size of buffer allocations initiated from sandboxed code. The enforcement logic in lib/setup-sandbox.js wraps specific Buffer constructors and validates size arguments before delegating to the host implementation. The wrapper does not intercept every path that reaches the native allocator.
Specifically, Buffer.concat(list, totalLength) and Buffer.from(arrayLike) accept caller-provided length values that flow directly to Node's native buffer allocator without size validation. Sandbox code can request buffers far larger than the configured cap. Because Node.js buffers are backed by external, off-heap memory, these allocations bypass V8 heap limits and consume host process memory directly. The weakness is classified as [CWE-770] Allocation of Resources Without Limits or Throttling.
Root Cause
The bufferAllocLimit guard is applied to a subset of Buffer construction APIs. The Buffer.concat path uses the caller-supplied totalLength argument to allocate a destination buffer, and the Buffer.from(arrayLike) path derives allocation size from the input object's length property. Neither path consults the sandbox's configured allocation cap.
Attack Vector
An attacker who can submit JavaScript to a vm2 sandbox invokes Buffer.concat with a crafted totalLength or Buffer.from with an object whose length reports a very large value. The synchronous allocation blocks the event loop and inflates the host process's resident memory. Repeated invocations or a single sufficiently large request forces the operating system to terminate the Node.js process or degrade service across all tenants sharing the host. Refer to the GitHub Security Advisory GHSA-gmc2-2x9w-cgh9 for further technical detail.
Detection Methods for CVE-2026-47683
Indicators of Compromise
- Sudden spikes in resident set size (RSS) of Node.js processes hosting vm2 sandboxes
- ENOMEM errors, out-of-memory kills, or SIGKILL entries in host logs correlated with sandbox activity
- Event loop stalls or unresponsive health checks on services that accept untrusted scripts
Detection Strategies
- Inventory Node.js applications and dependency trees for vm2 versions below 3.11.6 using software composition analysis
- Instrument sandboxed workloads to record Buffer.concat and Buffer.from call sizes and alert on outliers
- Correlate sandbox job submissions with process memory metrics to identify tenants triggering large allocations
Monitoring Recommendations
- Ship Node.js process metrics (RSS, external memory, event loop lag) to a centralized telemetry pipeline
- Alert on host OOM-killer events referencing Node.js processes running vm2 workloads
- Track error rates and restart counts for services exposing sandbox execution endpoints
How to Mitigate CVE-2026-47683
Immediate Actions Required
- Upgrade vm2 to version 3.11.6 in all Node.js applications that execute untrusted code
- Audit dependency lockfiles and transitive dependencies for older vm2 versions and force resolution to the patched release
- Restrict which principals can submit code to vm2 sandboxes until the upgrade is deployed
Patch Information
The fix is available in vm2 3.11.6. The maintainers extended bufferAllocLimit enforcement to cover Buffer.concat(list, totalLength) and Buffer.from(arrayLike). Review the GitHub Release v3.11.6 and the corresponding GitHub Commit Update for the applied changes. Note that the vm2 project has been deprecated by its maintainers; teams should plan migration to an actively maintained sandbox such as isolated-vm.
Workarounds
- Enforce per-process memory limits using operating system controls such as cgroups, ulimit -v, or container memory caps
- Wrap Buffer.concat and Buffer.from inside the sandbox context with custom validators that reject oversized length arguments
- Terminate sandbox worker processes after each job to bound the impact of a successful exhaustion attempt
# Configuration example
# Upgrade vm2 to the patched release
npm install vm2@3.11.6 --save
npm ls vm2
# Verify no older versions remain in the dependency tree
npm audit --production
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
