The bufferAllocLimit option in vm2 (version 3.11.0 and later) is designed to cap memory allocations via Buffer.alloc and related Buffer constructors to prevent excessive memory use. However, this defense is bypassed because ArrayBuffer, SharedArrayBuffer, and all TypedArray constructors allocate memory through the same V8/libuv C++ allocation path but are not intercepted by the bufferAllocLimit check. This allows an attacker to allocate large amounts of memory synchronously, which cannot be interrupted by V8's timeout mechanism, leading to host process memory exhaustion and denial of service. The vulnerability affects vm2 versions before 3.11.6 and is exploitable in any Node.js environment. The attack complexity is low, and the impact is a complete availability loss due to out-of-memory kills in memory-constrained environments.

This vulnerability enables an attacker to cause a denial of service by exhausting the host system's memory through large synchronous allocations using ArrayBuffer or TypedArray constructors inside the vm2 sandbox. The host process can be killed by the operating system's out-of-memory (OOM) killer, especially in environments with strict memory limits such as Docker containers, Kubernetes pods, or AWS Lambda functions. The attack requires no privileges or user interaction and bypasses the intended bufferAllocLimit protection, resulting in a high availability impact.

A patch is available for vm2 that addresses this vulnerability. Operators should upgrade to vm2 version 3.11.6 or later to ensure the bufferAllocLimit defense properly covers all memory allocation paths including ArrayBuffer and TypedArray constructors. Until patched, relying solely on bufferAllocLimit does not prevent memory exhaustion via these bypass methods.