CVE-2026-100723: vm2 Package Vulnerability Exposes Host Memory via zlib Buffers
Summary
CVE-2026-100723: vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary. Affects vm2 versions < 3.12.2. Fixed in 3.12.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vm2 package is a popular Node.js library that provides a sandboxed environment for executing untrusted code securely. It allows developers to run JavaScript code in a controlled manner, isolating it from the host environment. However, a vulnerability has been discovered in the way vm2 handles the Node.js zlib module, which can lead to exposure of sensitive host memory to untrusted guest code.
Vulnerability Detail
The vulnerability arises when the Node.js zlib module is explicitly exposed through vm2's NodeVM allowlist. An untrusted guest can exploit this by obtaining a pooled host Buffer from zlib.deflateSync, allowing them to read bytes outside the compressed result and potentially modify unrelated host buffers. This breach of isolation can lead to significant confidentiality and integrity issues, as sensitive data may be disclosed or corrupted. The vulnerability is particularly concerning because it allows for both memory disclosure and unauthorized memory modification.
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating is not immediately possible, avoid exposing the zlib module through the vm2 NodeVM allowlist. This can be done by not including 'zlib' in the require: { builtin: [...] } configuration when creating a NodeVM instance.
Conclusion
The vm2 package vulnerability (CVE-2026-100723) poses a significant risk by allowing untrusted code to access and modify host memory through the zlib module. It is crucial to update to the patched version (3.12.2 or later) to maintain the security of your application. Additionally, using tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for vm2 →
FAQ
The CVSS score for this vulnerability is 10.0, indicating a critical severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
The vulnerability can lead to unauthorized access to sensitive data and the ability to modify host memory, compromising the integrity and confidentiality of the application.
Yes, you can mitigate the risk by not exposing the zlib module in your vm2 configuration, thus preventing untrusted code from accessing it.
If immediate updating is not feasible, ensure that your application does not allow the use of the zlib module in the vm2 sandbox until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
