p PatchFirst

CVE-2026-100723

CVE-2026-100723 · vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through NodeVM's builtin allowlist (require: { builtin: ['zlib'] }), zlib.deflateSync can return a Buffer backed by Node's shared small-buffer pool whose .buffer is the entire pool. Untrusted guest code can construct a full-width view of that ArrayBuffer (Buffer.from(result.buffer, 0, result.buffer.byteLength)) to read and modify bytes belonging to unrelated host buffers, disclosing and corrupting host-realm memory across the sandbox boundary.

CVSS 6.9 · Moyenne · EPSS 0,4% · Code d’exploitation public · Correctif disponible

Publication
Mise à jour

Pile logicielle: node

Produits et versions concernés

  • vm2

    Versions du logiciel
    • ≥ 0, < 3.12.2: Concernée (semver)
    • 3.12.2: Non concernée (semver)

    Mettez à jour vers 3.12.2

  • vm2 npm

    Plages de versions concernées
    • SEMVER: < 3.12.2

    Mettez à jour vers 3.12.2

Sources originales

Vérifiez votre serveur →