PT-2026-38395 · Npm · Vm2

Kodove · Published 2026-05-01 · Updated 2026-06-04 · CVE-2026-44004

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.0

Description Sandboxed code can call the Buffer.alloc() function with an arbitrary size to allocate memory directly on the host heap. Because Buffer.alloc() is a synchronous C++ native call, the timeout option cannot interrupt the execution. This allows a single request to exhaust host memory, leading to a process crash with a FATAL ERROR: Reached heap limit. The issue occurs because the Buffer object is exposed to the sandbox through the HOST object, and the bridge proxy in lib/bridge.js passes these calls to the host without size validation.

Recommendations Update to version 3.11.0.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-1285

CWE-770

Related Identifiers

BDU:2026-06910

CVE-2026-44004

GHSA-6785-PVV7-MVG7

Affected Products

Vm2

References · 11

• 🔥 https://github.com/patriksimek/vm2/security/advisories/GHSA-6785-pvv7-mvg7 · Exploit
• https://bdu.fstec.ru/vul/2026-06910 · Security Note
• https://osv.dev/vulnerability/GHSA-6785-pvv7-mvg7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44004 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-44004 · Vendor Advisory
• https://github.com/patriksimek/vm2 · Note
• https://github.com/patriksimek/vm2/releases/tag/v3.11.0 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2477195 · Note
• https://twitter.com/DFIR_Lab/status/2059793097811169337 · Twitter Post
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44004.json · Note
• https://access.redhat.com/security/cve/CVE-2026-44004 · Note