CVE-2026-92961 in vm2
Summary
by MITRE • 09/17/2026
vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors, allowing attackers to allocate arbitrary host memory. Attackers can bypass the buffer allocation cap by using these V8 intrinsics to exhaust host process memory and trigger out-of-memory conditions.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in versions of vm2 prior to 3.11.6 represents a critical failure in resource management within JavaScript sandboxing environments, specifically affecting how the library handles binary data structures provided by the V8 engine. The core issue lies in the improper enforcement of the bufferAllocLimit configuration parameter when instantiating ArrayBuffer, SharedArrayBuffer, and various TypedArray objects such as Int32Array or Float64Array. In a properly secured sandboxed environment, these limits are designed to prevent untrusted code from consuming excessive amounts of host system memory, thereby protecting the underlying process from denial-of-service conditions caused by resource exhaustion. However, due to this implementation flaw, attackers can bypass these allocated caps entirely by directly invoking the constructors for these specific V8 intrinsics without triggering the expected validation checks that would otherwise restrict allocation size based on the configured limit.
From a technical perspective, this vulnerability exploits the gap between high-level sandbox configuration and low-level engine object instantiation. When an attacker provides malicious input intended to create large binary buffers, the vm2 library fails to intercept or validate these requests against the bufferAllocLimit threshold before passing them to the V8 runtime. This allows for arbitrary host memory allocation, meaning that a single request can consume megabytes or gigabytes of RAM depending on system capabilities and available resources. The impact is severe because it leads directly to out-of-memory conditions within the hosting process. In server-side applications utilizing vm2 for code execution, such as online coding platforms or automated testing environments, this flaw enables remote attackers to crash the application by exhausting all available memory, resulting in a complete denial of service that affects not only the targeted user but potentially other tenants if running on shared infrastructure.
This vulnerability aligns with CWE-789, which describes Memory Allocation with Excessive Size, as well as CWE-400, concerning Uncontrolled Resource Consumption. The exploitation technique is consistent with ATT&CK tactic T1499, Endpoint Denial of Service, specifically the method known as OS Exhaustion Flood or Application Exhaustion Flood via resource consumption. By leveraging these specific JavaScript constructors to bypass security controls, an attacker effectively performs a memory exhaustion attack that circumvents standard sandboxing protections designed to isolate untrusted code from host resources.
To mitigate this vulnerability, organizations must immediately upgrade vm2 to version 3.11.6 or later where the buffer allocation limits are correctly enforced for all relevant V8 intrinsic types including ArrayBuffer and TypedArrays. In environments where upgrading is not immediately feasible, implementing strict input validation on any data passed to sandboxed code that results in binary object creation can provide a partial workaround by limiting payload sizes before they reach the vulnerable constructors. Additionally, deploying runtime application self-protection tools or host-level memory limits such as cgroups on Linux systems can help contain the blast radius of an exploitation attempt by restricting the maximum memory footprint allowed for specific processes. Regular auditing of sandbox configurations and ensuring that security parameters like bufferAllocLimit are actively monitored during execution is essential to maintaining robust defense-in-depth strategies against resource exhaustion attacks in JavaScript-based sandboxes.