Executive brief
vm2 is a popular tool used to safely run untrusted code in Node.js environments. A flaw allows an attacker to bypass security limits and force the host system to allocate massive amounts of memory instantly. This can lead to a complete service crash (Denial of Service), especially in cloud environments like Docker or Kubernetes where memory is strictly limited.
Technical details
A vulnerability in vm2's bridge proxy allows sandboxed code to call the native 'Buffer.alloc()' function with arbitrary size parameters. Because this is a synchronous C++ native call, it bypasses vm2's JavaScript-level timeout mechanism, which cannot interrupt the execution until the allocation completes. An attacker can trigger a massive allocation with a single request, leading to host heap exhaustion and a 'FATAL ERROR: Reached heap limit' crash. This is particularly effective in memory-constrained environments like Docker, Lambda, or Kubernetes. The issue is fixed in version 3.11.0 by validating allocation sizes.
Affected products
- patriksimek vm2 < 3.11.0
- Red Hat Self-service automation portal 2 2
Timeline
- 2026-05-01: advisory: GitHub advisory GHSA-6785-pvv7-mvg7 published
- 2026-05-13: disclosed: CVE-2026-44004 published
- 2026-05-13: patched: Fixed in version 3.11.0