Quick answers
- Is CVE-2026-92947 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-92947 being exploited in the wild.
- How severe is CVE-2026-92947?
- Critical severity, with a CVSS score of 10, published 17 September 2026.
- Which products and versions are affected?
- vm2 (npm) <= 3.11.6, SEMVER:introduced=0,fixed=3.11.7.
- Is there a fix for CVE-2026-92947?
- Yes. vm2 (npm): upgrade to 3.11.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-92947 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-92947?
- Check whether you run vm2 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- vm2 (npm): upgrade to 3.11.7 or later
npm install vm2@3.11.7
Technical details
vm2 exposes Node's Buffer object to sandboxed code by default. Small Buffer allocations (Buffer.allocUnsafe, Buffer.from, Buffer.concat) reuse a shared pool that is accessible from both the host and sandbox realms. An attacker can acquire an ArrayBuffer pointing to this shared pool and read or write to host memory, bypassing sandbox boundaries. This is an isolation/compartmentalization failure (CWE-653, CWE-668) enabling unauthorized information disclosure and potential data modification. The vulnerability affects versions before 3.11.7; no authentication or user interaction is required to exploit it. A fix is available in version 3.11.7.
Affected products
- patriksimek vm2 before 3.11.7
Identifiers
- CVE-2026-92947
- GHSA-fcqc-726x-5wfc
Timeline
- 2026-08-24: disclosed: GitHub Security Advisory GHSA-fcqc-726x-5wfc published
- 2026-09-17: advisory: CVE-2026-92947 assigned and published on NVD
- 2026: patched: Fix released in version 3.11.7