Executive brief
vm2 is a JavaScript sandbox library that allows safe execution of untrusted code. The library offers a bufferAllocLimit setting to prevent denial-of-service attacks through memory exhaustion. However, this protection can be completely bypassed using ArrayBuffer, SharedArrayBuffer, or TypedArray constructors, which allocate host memory without restriction. An attacker can exhaust host system memory and trigger out-of-memory kills in containerized environments (Docker, Kubernetes, AWS Lambda), causing service outages.
Technical details
The vulnerability is a resource exhaustion bypass (CWE-770) in vm2's bufferAllocLimit defense mechanism. The bufferAllocLimit option (introduced in v3.11.0) successfully prevents allocation via Buffer.alloc() and related Buffer constructors by intercepting calls in setup-sandbox.js. However, ArrayBuffer, SharedArrayBuffer, Uint8Array, Float64Array, and other TypedArray constructors are V8 intrinsics that bypass this check and allocate host memory through the identical underlying C++ path (v8::ArrayBuffer::NewBackingStore → ArrayBufferAllocator::Allocate → calloc/malloc). An attacker can call new ArrayBuffer(N) with arbitrarily large N values in a single synchronous allocation that cannot be interrupted by V8's timeout mechanism. In memory-constrained environments (containers, Lambda), repeated large allocations cause out-of-memory conditions and process termination. The vulnerability affects all Node.js versions and any vm2 configuration including the default. Fixed in version 3.11.6.
Affected products
- patriksimek vm2 <= 3.11.5
Timeline
- 2026-08-17: disclosed: Published to GitHub Advisory Database
- 2026-08-17: patched: Patch released in vm2 v3.11.6
References
- https://api.github.com/users/Kr1shna4garwal
- https://github.com/Kr1shna4garwal
- https://api.github.com/users/Kr1shna4garwal/gists%7B/gist_id%7D
- https://api.github.com/users/Kr1shna4garwal/repos
- https://avatars.githubusercontent.com/u/85845881?v=4
- https://api.github.com/users/Kr1shna4garwal/events%7B/privacy%7D