CVE-2026-100723
Deferred Deferred - Pending Action

Buffer Corruption in vm2 via zlib.deflateSync

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: VulnCheck

Description
vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through NodeVM's builtin allowlist (require: { builtin: ['zlib'] }), zlib.deflateSync can return a Buffer backed by Node's shared small-buffer pool whose .buffer is the entire pool. Untrusted guest code can construct a full-width view of that ArrayBuffer (Buffer.from(result.buffer, 0, result.buffer.byteLength)) to read and modify bytes belonging to unrelated host buffers, disclosing and corrupting host-realm memory across the sandbox boundary.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2026-100723
EUVD
EUVD-2026-87856

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
patriksimek vm2 to 3.12.2 (exc)
patriksimek vm2 3.11.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the vm2 library before version 3.12.2. When the zlib module is exposed through NodeVM's builtin allowlist, zlib.deflateSync can return a Buffer backed by Node.js's shared small-buffer pool. Untrusted guest code can then create a full-width view of the ArrayBuffer to read or modify bytes belonging to unrelated host buffers, compromising host-realm memory across the sandbox boundary.

Detection Guidance

Check if your system uses vm2 version before 3.12.2 by running: npm list vm2. If the version is older, the system is vulnerable. Inspect Node.js applications that use vm2 and expose the zlib module through NodeVM's builtin allowlist.

Impact Analysis

This vulnerability allows untrusted guest code to read sensitive host memory, potentially exposing confidential data. It can also corrupt host buffers, affecting data integrity. Applications not exposing the zlib builtin are unaffected. The impact includes confidentiality and integrity breaches across the sandbox boundary.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Compliance may be compromised if sensitive data is exposed or altered due to the memory disclosure and corruption risks.

Mitigation Strategies

Upgrade vm2 to version 3.12.2 or later immediately. Avoid exposing the zlib module in NodeVM's builtin allowlist if not strictly necessary. Review applications using vm2 for unnecessary builtin module exposures.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100723. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart