Memory Exhaustion DoS in vm2: Bypass of bufferAllocLimit
Summary
GHSA-v836-6xw4-9cx3: vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass. Affects vm2 versions < 3.11.6. Fixed in 3.11.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vm2 is a popular Node.js package that provides a secure sandbox for executing untrusted JavaScript code. It allows users to run code in a controlled environment, isolating it from the host system. The package includes features like memory limits and resource controls to prevent abuse. However, a recent vulnerability has been discovered that undermines its memory allocation protections, specifically the bufferAllocLimit feature.
Vulnerability Detail
The vulnerability arises from the ability to bypass the bufferAllocLimit defense in vm2 versions prior to 3.11.6. While the bufferAllocLimit is intended to cap memory allocation for Buffer objects, it does not apply to ArrayBuffer, SharedArrayBuffer, or TypedArray constructors. This oversight allows an attacker to allocate large amounts of memory, leading to Denial of Service (DoS) by exhausting the host's memory resources. The vulnerability can be exploited easily, as a single call to new ArrayBuffer(N) with a large N can exhaust the host's memory, causing the process to be killed in constrained environments like Docker or Kubernetes.
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.11.6
This is the first release that contains the fix.
npm install vm2@3.11.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using ArrayBuffer, SharedArrayBuffer, or TypedArray constructors in your sandboxed code. Instead, stick to using Buffer methods that are subject to the bufferAllocLimit. Here is an example of how to restrict memory allocation:
const { VM } = require('vm2');
const vm = new VM({ bufferAllocLimit: 10 * 1024 * 1024 }); // 10MB cap
try {
vm.run('Buffer.alloc(20 * 1024 * 1024)');
} catch (e) {
console.log('Buffer allocation blocked:', e.message);
}
Conclusion
The vm2 package has a critical vulnerability that allows for memory exhaustion attacks by bypassing the bufferAllocLimit feature. Users are strongly advised to update to version 3.11.6 or later to mitigate this risk. Additionally, temporary workarounds can help reduce exposure until an update can be applied.
See every vulnerability recorded for vm2 →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
vm2 versions prior to 3.11.6 are affected by this vulnerability.
Environments with memory constraints, such as Docker containers, Kubernetes pods, and AWS Lambda, are particularly at risk.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If you cannot update the package immediately, avoid using ArrayBuffer and similar constructors in your code to mitigate the risk of memory exhaustion.
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
