Information disclosure in vm2 - #VU161911
Published: November 8, 2026
Vulnerability identifier: #VU161911
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to read sensitive host memory and corrupt unrelated host buffers across the vm2 sandbox boundary.
The vulnerability exists due to shared backing memory exposed by buffers returned from zlib in NodeVM when the host explicitly allowlists that builtin. An unauthenticated remote attacker can execute guest code that calls zlib.deflateSync and creates a full backing-store view to read and modify bytes outside the compressed result.
Affected software
vm2
Remediation
Install security update from vendor's website.
vm2 - update to 3.12.2