CVE-2026-100723

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.12.2

Description The software fails to apply the Buffer backing-store ownership invariant to Buffers returned from host builtin modules. When the zlib module is exposed via the NodeVM builtin allowlist, the zlib.deflateSync() function can return a Buffer backed by the shared small-buffer pool. This allows untrusted guest code to create a full-width view of the ArrayBuffer to read and modify bytes from unrelated host buffers, leading to memory disclosure and corruption across the sandbox boundary.

Recommendations Update to version 3.12.2 or later. Restrict the use of the zlib module in the NodeVM builtin allowlist to minimize the risk of exploitation.