AIKIDO-2026-664356
vm2 is vulnerable to Denial of Service (DoS)
87
High Risk
This Affects:
vm2TL;DR
vm2's bufferAllocLimit option is meant to cap how much host memory sandbox code can allocate through Buffer. The cap is not applied to Buffer.concat or Buffer.from when given an array-like object with a large length. Untrusted sandbox code can therefore allocate unbounded host memory in a single call that the VM timeout cannot stop, exhausting the host process. The fix applies the existing limit check to both APIs.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you rely on bufferAllocLimit to bound the host memory that untrusted sandbox code can allocate.
Background info
vm2 is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 3.11.5.
How to fix this
Upgrade the vm2 library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant