GHSA-43rv-jrfh-9mrr

Duplicate Advisory: vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary

Published

2026-09-27

Modified

2026-10-05

Sources

github-advisory

Summary

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-489w-w794-jq94. This link is maintained to preserve external references. ## Original Description vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through NodeVM's builtin allowlist (require: { builtin: ['zlib'] }), zlib.deflateSync can return a Buffer backed by Node's shared small-buffer pool whose .buffer is the entire pool. Untrusted guest code can construct a full-width view of that ArrayBuffer (Buffer.from(result.buffer, 0, result.buffer.byteLength)) to read and modify bytes belonging to unrelated host buffers, disclosing and corrupting host-realm memory across the sandbox boundary.

Affected packages

Remediation: Upgrade to 3.12.2 or later.

References

• https://github.com/advisories/GHSA-43rv-jrfh-9mrr