AIKIDO-2026-687134
vm2 is vulnerable to Denial of Service (DoS)
75
High Risk
This Affects:
vm2TL;DR
The bufferAllocLimit option caps host memory allocations made through Buffer.alloc methods, but ArrayBuffer, SharedArrayBuffer, and every TypedArray constructor allocate host memory through the same underlying engine path without being subject to the cap. Untrusted sandbox code requests a very large allocation in a single call that the execution timeout cannot preempt. This exhausts host process memory and can trigger out-of-memory termination in containerized or memory-limited deployments. The fix extends the allocation-limit enforcement to these constructors.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you rely on bufferAllocLimit to bound the host memory that untrusted sandbox code can allocate.
Background info
vm2 is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 3.11.5.
How to fix this
Upgrade the vm2 library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant