Executive brief
vm2 is a Node.js library that runs untrusted JavaScript code in an isolated sandbox. The bufferAllocLimit feature allows application developers to set a per-allocation memory cap as a defense against hostile code. However, two memory allocation paths—Buffer.concat() and Buffer.from() with array-like inputs—are not subject to this cap. An attacker can call either function with a large size parameter to force the host process to allocate hundreds of megabytes in a single operation, crashing the application with an out-of-memory error. This defeats the security hardening measure administrators rely on to prevent denial-of-service attacks.
Technical details
The vulnerability is a resource-exhaustion flaw (CWE-770) in vm2's sandbox memory isolation. The bufferAllocLimit mechanism wraps Buffer.alloc(), Buffer.allocUnsafe(), Buffer.allocUnsafeSlow(), and deprecated Buffer(N) constructors with a checkBufferAllocLimit() guard, but two other paths to the underlying Node.js Buffer allocator are not wrapped: Buffer.concat(list, totalLength) and Buffer.from(arrayLike) when arrayLike is an object with a numeric length property. Because these methods call Node's internal C++ allocator directly, they bypass the sandbox's allocation guard and can allocate arbitrary sizes. The attack requires only network access to the vm2 host (for code injection into the sandbox) and no special privileges. A 200-byte payload can trigger a multi-hundred-megabyte allocation synchronously—faster than V8's timeout mechanism can interrupt—causing the process to OOM. A patch is available in version 3.11.6.
Affected products
- patriksimek vm2 <= 3.11.5
Timeline
- 2026-08-17: disclosed
- 2026-08-17: patched: Version 3.11.6 released
- 2026-08-14: other: Published to GitHub Advisory Database