7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44004

CVE-2026-44004: vm2: Host Process OOM DoS via Buffer.alloc (Timeout Bypass)

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, sandboxed code can call Buffer.alloc() with an arbitrary size to allocate memory directly on the host heap. Because Buffer.alloc is a synchronous C++ native call, vm2's timeout option cannot interrupt it. A single request can exhaust host memory and crash the process with a FATAL ERROR: Reached heap limit. This vulnerability is fixed in 3.11.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44004

CVE-2026-44004:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
vm2	npm	<= 3.10.5	3.11.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-6785-pvv7-mvg7, allows sandboxed code in vm2 to cause a Denial of Service (DoS) by exhausting host memory. This is achieved by calling Buffer allocation methods like Buffer.alloc() with an arbitrarily large size. These native C++ allocation calls are synchronous and cannot be interrupted by vm2's timeout mechanism, allowing a single small request to crash the entire Node.js process with an Out-of-Memory (OOM) error.

The vulnerability is not caused by a flaw within a single function but by the lack of size validation on multiple functions that bridge Buffer allocations from the sandbox to the host. The fix introduces a new bufferAllocLimit option in the VM and NodeVM constructors. This limit is then enforced within wrappers around the vulnerable allocation functions.

The analysis of the patch identified the exact locations where these checks were added, revealing the vulnerable pathways:

VM.constructor and NodeVM.constructor: The vulnerability was exploitable by default. The patch adds the bufferAllocLimit option to allow users to opt into the protection. The NodeVM.constructor was also patched to correctly propagate this security setting to the underlying VM.
BufferHandler.apply and BufferHandler.construct: These methods in lib/setup-sandbox.js handle the deprecated Buffer(N) and new Buffer(N) syntax. They were vulnerable because they passed the allocation size directly to the host without validation.
alloc, allocUnsafe, and allocUnsafeSlow: These functions in lib/setup-sandbox.js are wrappers for the corresponding Buffer methods. The patch added the checkBufferAllocLimit call to them to prevent unbounded allocations. The vulnerability existed because this check was previously absent.

An engineer seeing this CVE in their environment should understand that any vm2 instance without a properly configured bufferAllocLimit is vulnerable to a DoS attack from the sandboxed code.

Vulnerable functions

VM.constructor

lib/vm.js

The VM constructor is the entry point for creating a sandbox. The vulnerability is exploitable in the default configuration. The patch introduced the `bufferAllocLimit` option to allow users to mitigate the vulnerability by setting a cap on buffer allocations. Without this option set to a reasonable limit, the sandbox is vulnerable.

NodeVM.constructor

lib/nodevm.js

This constructor for the `NodeVM` class initially failed to propagate the `bufferAllocLimit` setting to the underlying `VM` instance. This meant that even if a user configured the limit, it would be ignored, leaving the `NodeVM` instance vulnerable to the memory exhaustion attack.

BufferHandler.apply

lib/setup-sandbox.js

This function acts as a trap for when `Buffer(...)` is called as a function from within the sandbox. Before the patch, it directly passed the allocation size to the host's `Buffer.alloc` method without any validation, allowing an attacker to trigger an unbounded memory allocation.

BufferHandler.construct

lib/setup-sandbox.js

This function acts as a trap for when `new Buffer(...)` is called from within the sandbox. Similar to `BufferHandler.apply`, it previously passed the allocation size directly to the host's `Buffer.alloc` method without validation, enabling the memory exhaustion vulnerability.

alloc

lib/setup-sandbox.js

While not a vulnerable function itself, the creation of this wrapper function indicates that the original `Buffer.alloc` was previously exposed to the sandbox without a size check. This new function intercepts calls to `Buffer.alloc`, validates the size against `bufferAllocLimit` using the `checkBufferAllocLimit` helper, and only then delegates to the original host function. The vulnerability existed in the absence of this wrapper.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.