GHSA-v836-6xw4-9cx3 — vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass

Affected: npm: vm2

### Summary:

The `bufferAllocLimit` defense (GHSA-6785-pvv7-mvg7) can be completely bypassed using `ArrayBuffer`, `SharedArrayBuffer`, or any `TypedArray` constructor. These allocate identical host-process RSS through the same V8/libuv C++ allocation path as `Buffer.alloc` but are not subject to the size cap.

### Details:

The `bufferAllocLimit` option (vm2 v3.11.0+) caps `Buffer.alloc`, `Buffer.allocUnsafe`, `Buffer.allocUnsafeSlow`, and the deprecated `Buffer(N)` / `new Buffer(N)` forms. The cap is enforced in `setup-sandbox.js` via `checkBufferAllocLimit()` (line 353-359).

However, `ArrayBuffer`, `SharedArrayBuffer`, `Uint8Array`, `Float64Array`, and all other TypedArray constructors are sandbox-realm V8 intrinsics that allocate host memory through the SAME underlying C++ path (`v8::ArrayBuffer::NewBackingStore` → `ArrayBufferAllocator::Allocate` → `calloc/malloc`). These constructors are NOT intercepted by the `bufferAllocLimit` defense.

A single `new ArrayBuffer(N)` call with a large `N` exhausts host RSS in one synchronous allocation that V8's `timeout` cannot interrupt.

### Environment:

- vm2 version: 3.11.3 - Node.js: v25.8.1 (affects all Node.js versions) - Configuration: Default `new VM()` or any configuration including `bufferAllocLimit`

### POC:

```javascript const { VM } = require('vm2');

// Operator sets bufferAllocLimit thinking they're protected: const vm = new VM({ bufferAllocLimit: 10 * 1024 * 1024 }); // 10MB cap

// Buffer.alloc IS capped (as int…

Most recent entries from all

GHSA-v836-6xw4-9cx3 — vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass