The patriksimek vm2 sandbox for Node.js before version 3.11.0 allows sandboxed code to call Buffer.alloc() with an arbitrary size, allocating memory directly on the host heap. Since Buffer.alloc() is a synchronous native C++ call, vm2's timeout option cannot interrupt it, enabling a single request to exhaust host memory and crash the process with a fatal heap limit error. This is categorized under CWE-770: Allocation of Resources Without Limits or Throttling. The vulnerability has a CVSS 3.1 base score of 7.5 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts availability only. The issue is resolved in vm2 version 3.11.0.

Exploitation allows an attacker to cause a denial of service by exhausting the host's memory, leading to a process crash with a fatal heap limit error. There is no impact on confidentiality or integrity, only availability is affected.

This vulnerability is fixed in vm2 version 3.11.0. Users should upgrade to version 3.11.0 or later to remediate this issue. No other mitigation or temporary fix is indicated. Patch status is confirmed by the vendor's versioning information.