CVE-2026-44004
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A vulnerability in the vm2 library for Node.js prior to version 3.11.0 allows sandboxed code to call Buffer.alloc() with an arbitrary size, allocating memory directly on the host heap. Because Buffer.alloc is a synchronous C++ native call, vm2's timeout option cannot interrupt it, enabling a single request to exhaust host memory and crash the process.
Risk Assessment
The risk is that a single request can exhaust server memory and crash the process, resulting in a denial of service (DoS). An attacker can exploit this vulnerability to perform a DoS attack without requiring special privileges.
Recommendation
Immediately update the vm2 library to version 3.11.0 or later, which contains the fix for this vulnerability. If an update is not possible, consider implementing additional memory allocation limits at the container or operating system level.
Other vulnerabilities in vm2
See all- CVE-2026-47698Critical
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, lib/bridge.js and lib/setup-sandbox.js fail to block stacked indirection through Function.prototype.call around dangerous host prototype getter and setter mutators, allowing sandbox code to sever a host intrinsic's prototype chain and reach e.constructor.constructor for arbitrary host command execution. This issue is fixed in version 3.11.6.
- CVE-2026-47686Critical
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, handleException() in lib/setup-sandbox.js sanitizes SuppressedError.error, SuppressedError.suppressed, and AggregateError.errors but does not sanitize Error.cause, allowing sandbox code to obtain a powerful host object such as process from an embedder-exposed host function that throws an error with that object as its cause and then execute arbitrary host commands. This issue is fixed in version 3.11.6.
- CVE-2026-47210Critical
In vm2, prior to version 3.11.4, a sandbox escape vulnerability allowed arbitrary code execution in the host process when untrusted code was executed with async support. This issue has been patched in version 3.11.4.
- CVE-2026-47208Critical
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, vm2 suffers from a sandbox breakout vulnerability, allowing attackers to execute arbitrary commands on the host system.
- CVE-2026-47140Critical
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangerous Node.js builtins, but the denylist misses process and inspector/promises, allowing sandboxed code to bypass restrictions.
- CVE-2026-47137Critical
In versions prior to 3.11.4, the vm2 library contained a vulnerability that allowed bypassing security related to the 'nesting: true' and 'require: false' options. The strict equality check in the code did not function correctly, enabling unauthorized requirements.
- CVE-2026-47131Critical
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, by combining certain calls, it was possible to obtain the host's TypeError constructor, allowing escape from the sandbox and execution of arbitrary code.
- CVE-2026-45411Critical
In the vm2 library for Node.js prior to version 3.11.3, a vulnerability allows catching a host exception using the yield* expression inside an async generator. Closing the generator with the return function causes the value to be awaited, and exceptions thrown in the then call can be caught and passed as the next value to the yield* iterator, enabling sandbox escape and arbitrary command execution on the host system.
- CVE-2026-44009Critical
A vulnerability in the vm2 library for Node.js allows sandbox escape. The issue is fixed in version 3.11.2.
- CVE-2026-44008Critical
A vulnerability in the vm2 library for Node.js prior to version 3.11.2 allows sandbox escape via the neutralizeArraySpeciesBatch method, which can call into the host side using a getter on the array prototype. This enables attackers to obtain host objects and the Function object, leading to arbitrary command execution on the host system.
Original NVD description (English source)
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, sandboxed code can call Buffer.alloc() with an arbitrary size to allocate memory directly on the host heap. Because Buffer.alloc is a synchronous C++ native call, vm2's timeout option cannot interrupt it. A single request can exhaust host memory and crash the process with a FATAL ERROR: Reached heap limit. This vulnerability is fixed in 3.11.0.