GHSA-v836-6xw4-9cx3: vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass

August 17, 2026

The bufferAllocLimit defense (GHSA-6785-pvv7-mvg7) can be completely bypassed using ArrayBuffer, SharedArrayBuffer, or any TypedArray constructor. These allocate identical host-process RSS through the same V8/libuv C++ allocation path as Buffer.alloc but are not subject to the size cap.

References

github.com/advisories/GHSA-v836-6xw4-9cx3
github.com/patriksimek/vm2/releases/tag/3.11.6
github.com/patriksimek/vm2/security/advisories/GHSA-v836-6xw4-9cx3

Code Behaviors & Features

Detect and mitigate GHSA-v836-6xw4-9cx3 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →