Duplicate Advisory: vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-489w-w794-jq94. This link is maintained to preserve external references. ## Original Description vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through NodeVM's builtin allowlist (require: { builtin: ['zlib'] }), zlib.deflateSync can return a Buffer backed by Node's shared small-buffer pool whose .buffer is the entire pool. Untrusted guest code can construct a full-width view of that ArrayBuffer (Buffer.from(result.buffer, 0, result.buffer.byteLength)) to read and modify bytes belonging to unrelated host buffers, disclosing and corrupting host-realm memory across the sandbox boundary.
GHSA-43rv-jrfh-9mrr
Primary source · Revision 1 · Withdrawn
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-43rv-jrfh-9mrr
vm2
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 3.12.2
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.12.2"
}
]
}
],
"package": {
"name": "vm2",
"purl": "pkg:npm/vm2",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-43rv-jrfh-9mrr/GHSA-43rv-jrfh-9mrr.json"
}
}
]Publisher severity
high
Source reference: /severity/0/score
- Event
- #85907 · Revision 1
- Added to Heist Feed
- Publisher date