LiveActive security incident?Get immediate response
CVE Record

CVE-2026-44004: vm2: Host Process OOM DoS via Buffer.alloc (Timeout Bypass)

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, sandboxed code can call Buffer.alloc() with an arbitrary size to allocate memory directly on the host heap. Because Buffer.alloc is a synchronous C++ native call, vm2's timeout option cannot interrupt it. A single request can exhaust host memory and crash the process with a FATAL ERROR: Reached heap limit. This vulnerability is fixed in 3.11.0.

HighCVSS 8.6Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

Applications using vm2 before 3.11.0 to run untrusted JavaScript can be crashed by code that consumes the host’s memory. The configured execution timeout does not stop this operation. This creates a high-impact availability risk, particularly when internet-facing requests can supply or trigger sandboxed code.

Executive priority

Treat this as a high-priority availability issue where public services run untrusted code through affected vm2 versions. Expedite the 3.11.0 upgrade for remotely reachable deployments. Other installations should be inventoried and scheduled promptly, while monitoring for memory-related crashes.

Technical view

Sandboxed code can request an arbitrarily large host-heap allocation through Buffer.alloc(). The allocation occurs synchronously in native C++ code, preventing vm2’s timeout mechanism from interrupting it. Memory exhaustion can terminate the Node.js host process. Versions before 3.11.0 are affected; 3.11.0 contains the fix.

Likely exposure

Exposure requires vm2 earlier than 3.11.0 and a path allowing untrusted or attacker-influenced JavaScript to execute inside it. Risk is greatest when an unauthenticated network request reaches such a sandbox. Deployments that do not execute untrusted code through vm2 are not shown by the supplied evidence to be affected.

Exploitation context

The CVSS 3.1 score is 8.6, reflecting potentially unauthenticated, low-complexity network exploitation with high availability impact. The supplied record does not place this CVE in KEV and provides no evidence of active exploitation. Actual remote reachability depends on how the application exposes vm2.

Researcher notes

The weakness maps to CWE-1285 and CWE-770: an attacker-controlled resource-consumption request is insufficiently constrained. The security boundary failure is that sandboxed code can initiate host memory allocation outside the timeout’s interruptible path. The supplied sources establish process-crash impact, not confidentiality loss, integrity loss, or active exploitation.

Mitigation direction

  • Upgrade vm2 to version 3.11.0 or later.
  • Prioritize internet-facing services that execute attacker-influenced JavaScript.
  • Restrict untrusted sandbox execution until affected deployments are upgraded.
  • Apply process memory limits and restart controls as defense-in-depth, not substitutes for upgrading.

Validation and detection

  • Inventory applications and dependency lockfiles for vm2 versions earlier than 3.11.0.
  • Confirm whether external input can reach vm2 sandbox execution paths.
  • Verify production artifacts resolve vm2 to version 3.11.0 or later.
  • Review monitoring for Node.js heap-limit failures and unexpected process restarts.
  • Run existing availability and sandbox regression tests after upgrading.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-1285: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cwe · low confidence lookup

CWE-770: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-44004 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.6 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
5Timeline events
2ADP providers
6Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: pocAutomatable: yesTechnical Impact: partial

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.6CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H3.94redhat-SADP
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6GitHub_M

Vulnerability scoring details

Base CVSS 3.1 score

8.6High
CVSS 3.1 vector shape for CVE-2026-44004Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. ADP timelineredhat-SADP

    Made public.

  3. CVE publishedCVE Program

    The CVE record was published.

  4. ADP timelineredhat-SADP

    Reported to Red Hat.

  5. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
redhat-SADPvm2: vm2: Denial of Service via host memory exhaustion
other:Red Hat severity ratingcvssV3_1
  • 2026-05-13T18:01:38.304Z: Reported to Red Hat.
  • 2026-05-13T17:31:16.281Z: Made public.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
patriksimekvm2< 3.11.0Listed
Weakness

CWE details

CWE-1285CWE-770

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.