vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool
At a glance
Severity
MEDIUM 6.9
EPSS
EPSS 0.39 % · percentile 33 (2026-10-27)
State
PUBLISHED
Published
Updated
Assigner
VulnCheck
NVD status
Deferred
Description
vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through NodeVM's builtin allowlist (require: { builtin: ['zlib'] }), zlib.deflateSync can return a Buffer backed by Node's shared small-buffer pool whose .buffer is the entire pool. Untrusted guest code can construct a full-width view of that ArrayBuffer (Buffer.from(result.buffer, 0, result.buffer.byteLength)) to read and modify bytes belonging to unrelated host buffers, disclosing and corrupting host-realm memory across the sandbox boundary.
