CVE-2026-100723: vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool
vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through NodeVM's builtin allowlist (require: { builtin: ['zlib'] }), zlib.deflateSync can return a Buffer backed by Node's shared small-buffer pool whose .buffer is the entire pool. Untrusted guest code can construct a full-width view of that ArrayBuffer (Buffer.from(result.buffer, 0, result.buffer.byteLength)) to read and modify bytes belonging to unrelated host buffers, disclosing and corrupting host-realm memory across the sandbox boundary.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using vm2 before 3.12.2 are exposed when they explicitly allow the Node.js zlib builtin in a NodeVM configuration with require: { builtin: ['zlib'] }. The issue requires untrusted guest code to be executed in that sandbox.
What must an attacker do to exploit it?
An attacker needs the ability to run guest code in the affected NodeVM and access the explicitly allowlisted zlib module. They can use zlib.deflateSync to obtain a pooled Buffer, then create a full-width Buffer view over its underlying ArrayBuffer.
Is the default NodeVM builtin configuration affected?
The described exposure depends on an application explicitly adding zlib to NodeVM's builtin allowlist. The provided information does not indicate that zlib is available without that explicit configuration.
What is the impact if exploitation succeeds?
Guest code can read and modify bytes from unrelated host buffers that share Node's small-buffer pool. This can disclose host-realm memory and corrupt data across the sandbox boundary.
What can be done if upgrading is not immediately possible?
Remove zlib from the NodeVM builtin allowlist and prevent untrusted guest code from accessing it. This removes the specific host-module path described for obtaining the shared pooled Buffer.