Executive brief
vm2 is a sandbox library for Node.js that executes untrusted code in an isolated virtual machine. The library's bufferAllocLimit defense was designed to prevent denial-of-service attacks by capping memory allocation through Buffer.alloc. However, attackers can completely bypass this protection using ArrayBuffer, SharedArrayBuffer, and TypedArray constructors to exhaust host memory and crash the process, even in resource-constrained environments like Docker containers and Kubernetes pods.
Technical details
The vulnerability is a resource exhaustion flaw in the bufferAllocLimit defense mechanism. The checkBufferAllocLimit() function in setup-sandbox.js intercepts and caps calls to Buffer.alloc, Buffer.allocUnsafe, Buffer.allocUnsafeSlow, and deprecated Buffer(N) forms. However, ArrayBuffer, SharedArrayBuffer, Uint8Array, Float64Array, and other TypedArray constructors are V8 intrinsics that allocate host memory through the identical underlying C++ path (v8::ArrayBuffer::NewBackingStore → ArrayBufferAllocator::Allocate → calloc/malloc) but bypass the size cap entirely. A single new ArrayBuffer(N) call with large N synchronously exhausts host RSS in one allocation that V8's timeout cannot interrupt. The attack requires no authentication or user interaction and is exploitable over the network in any deployment running vulnerable vm2 versions ≤3.11.5.
Affected products
- npm vm2 ≤3.11.5
Timeline
- 2026-08-17: disclosed
- 2026-08-17: patched: Fixed in vm2 3.11.6