CVE-2026-44004

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.0

Description Sandboxed code can call the Buffer.alloc() function with an arbitrary size to allocate memory directly on the host heap. Since Buffer.alloc() is a synchronous C++ native call, the timeout option provided by vm2 cannot interrupt the execution. This allows a single request to exhaust host memory and crash the process with a FATAL ERROR: Reached heap limit, leading to a denial of service. This issue is particularly severe in memory-constrained environments such as Docker, Kubernetes pods, or AWS Lambda, where it can cause an immediate Out-of-Memory (OOM) crash.

Recommendations Update vm2 to version 3.11.0.