Allocation of Resources Without Limits or Throttling in vm2 - CVE-2026-92961
Published: August 15, 2026 / Updated: September 18, 2026
Vulnerability identifier: #VU142652
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-92961
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the bufferAllocLimit defense in setup-sandbox.js when processing sandboxed code that invokes ArrayBuffer, SharedArrayBuffer, or TypedArray constructors. A remote attacker can execute crafted code in the sandbox to cause a denial of service.
A single large allocation can exhaust host memory through the underlying V8 and libuv allocation path, and the condition affects configurations that rely on bufferAllocLimit for memory allocation restrictions.
Affected software
vm2
How to mitigate CVE-2026-92961
Install security update from vendor's website.
vm2 - update to 3.11.6