REDHAT-BUG-2477195: High severity npm/vm2 vulnerability
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, sandboxed code can call Buffer.alloc() with an arbitrary size to allocate memory directly on the host heap. Because Buffer.alloc is a synchronous C++ native call, vm2's timeout option cannot interrupt it. A single request can exhaust host memory and crash the process with a FATAL ERROR: Reached heap limit. This vulnerability is fixed in 3.11.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vm2to a version that resolves this vulnerability.Fixed in 3.11.0
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2477195?
The severity of REDHAT-BUG-2477195 is classified as high with a severity score of 7.
How do I fix REDHAT-BUG-2477195?
To fix REDHAT-BUG-2477195, update vm2 to version 3.11.0 or later.
What does REDHAT-BUG-2477195 affect?
REDHAT-BUG-2477195 affects the npm/vm2 module used for sandboxing Node.js code.
What is the risk associated with REDHAT-BUG-2477195?
The risk associated with REDHAT-BUG-2477195 is that it allows sandboxed code to allocate arbitrary memory on the host, potentially exhausting host resources.
When was REDHAT-BUG-2477195 published?
REDHAT-BUG-2477195 was published on May 13, 2026.