cyfenced.com →

[ CVE-2026-100723 · Published 27 Sep 2026 ]

vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary

CVSS 7.5 EPSS <1%1 agency advisoryFix available

[ Why it matters ]Priority signals

  • Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through NodeVM's builtin allowlist (require: { builtin: ['zlib'] }), zlib.deflateSync can return a Buffer backed by Node's shared small-buffer pool whose .buffer is the entire pool. Untrusted guest code can construct a full-width view of that ArrayBuffer (Buffer.from(result.buffer, 0, result.buffer.byteLength)) to read and modify bytes belonging to unrelated host buffers, disclosing and corrupting host-realm memory across the sandbox boundary.

[ Fixes ]Fixes and patches

  • vm2 3.12.2Fixed version · GitHub Advisories · npm package vm2: upgrade to 3.12.2 or later (affected <= 3.12.1)

[ Advisories ]Government CERT advisories

[ Packages ]Affected open-source packages

[ References ]References