Allocation of Resources Without Limits or Throttling in vm2 - #VU142652
Published: August 15, 2026
Vulnerability identifier: #VU142652
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the bufferAllocLimit defense in setup-sandbox.js when processing sandboxed code that invokes ArrayBuffer, SharedArrayBuffer, or TypedArray constructors. A remote attacker can execute crafted code in the sandbox to cause a denial of service.
A single large allocation can exhaust host memory through the underlying V8 and libuv allocation path, and the condition affects configurations that rely on bufferAllocLimit for memory allocation restrictions.
Affected software
vm2
Remediation
Install security update from vendor's website.
vm2 - update to 3.11.6