CVE-2026-100723 Overview
CVE-2026-100723 is an information disclosure vulnerability in the vm2 sandbox library before version 3.12.2. The flaw lets guest code escape the sandbox memory boundary and read or modify host-realm memory. It occurs because vm2 does not enforce its Buffer backing-store ownership invariant on Buffers returned from host builtin modules. When an application exposes Node.js zlib through the NodeVM builtin allowlist, zlib.deflateSync can return a Buffer backed by Node's shared small-buffer pool. Untrusted guest code can then construct a full-width view of that ArrayBuffer to access unrelated host buffers [CWE-200].
Critical Impact
Guest code running inside a vm2 sandbox can read and corrupt arbitrary bytes from Node.js host-realm buffers, breaking the sandbox confidentiality boundary.
Affected Products
- vm2 versions prior to 3.12.2
- Node.js applications using NodeVM with require: { builtin: ['zlib'] }
- Any downstream library embedding vulnerable vm2 releases for untrusted code execution
Discovery Timeline
- 2026-09-27 - CVE-2026-100723 published to NVD
- 2026-09-27 - Last updated in NVD database
Technical Details for CVE-2026-100723
Vulnerability Analysis
The vm2 library enforces a Buffer backing-store ownership invariant: guest-visible Buffers must satisfy byteOffset === 0 and buffer.byteLength === length. This invariant prevents a guest from reaching beyond its allocated slice into the underlying ArrayBuffer. The sandbox applies the check to Buffers produced inside the guest realm but does not apply it to Buffers returned from host builtin modules routed through the require allowlist.
When an operator exposes zlib with require: { builtin: ['zlib'] }, calls such as zlib.deflateSync return small Buffers that Node allocates from a shared internal pool. The returned Buffer's .buffer property references the entire pool ArrayBuffer, not just the slice owned by the result. Guest code can read the byteOffset and byteLength of that ArrayBuffer and construct a new view spanning the entire pool, exposing bytes that belong to unrelated host-realm Buffers.
Root Cause
The root cause is incomplete enforcement of the Buffer ownership invariant across the host-guest trust boundary. The validation path that wraps or rejects pool-backed Buffers was not applied to values crossing from host builtins into the guest realm.
Attack Vector
Exploitation requires an application that exposes zlib to untrusted guest code through the NodeVM builtin allowlist. The attacker runs script inside the sandbox, invokes zlib.deflateSync, inspects the .buffer of the returned result, and allocates a new Buffer spanning the pool. The resulting view exposes host memory for both read and write operations without any additional privileges.
No verified public exploit code is published. See the VulnCheck VM2 Memory Disclosure Advisory and the GitHub Security Advisory GHSA-489w for additional technical detail.
Detection Methods for CVE-2026-100723
Indicators of Compromise
- Guest scripts inside NodeVM that reference .buffer, byteOffset, or byteLength of results returned from zlib builtins.
- Unexpected use of Buffer.from(result.buffer, 0, result.buffer.byteLength) patterns on compression output.
- Host process crashes or data corruption in objects adjacent in time to sandboxed script execution.
Detection Strategies
- Perform static code review of all NodeVM configurations and flag any policy that lists zlib in require.builtin.
- Audit package-lock.json and yarn.lock for vm2 versions below 3.12.2, including transitive dependencies.
- Monitor runtime for anomalous Buffer allocations from guest contexts that span sizes larger than the originating API output.
Monitoring Recommendations
- Enable Node.js runtime logging around NodeVM instantiation to capture builtin allowlist contents at startup.
- Alert on process-level memory corruption signals such as unexpected UTF-8 decode failures or JSON parse errors in long-lived host state.
- Track dependency drift using software composition analysis so that vulnerable vm2 releases trigger pipeline failures.
How to Mitigate CVE-2026-100723
Immediate Actions Required
- Upgrade vm2 to version 3.12.2 or later in all services that execute untrusted code.
- Remove zlib from any NodeVMrequire.builtin allowlist until upgrades are verified in production.
- Treat any historical sandbox output as potentially tainted and rotate secrets that may have resided in host memory during exposure windows.
Patch Information
The maintainers addressed the issue in vm23.12.2. The fix enforces the Buffer backing-store ownership invariant on values returned from host builtins by rewrapping or copying pool-backed Buffers before they cross into the guest realm. Review the GitHub Commit Fix and the companion GitHub Commit Update for the exact changes.
Workarounds
- Remove zlib from the NodeVM builtin allowlist and provide a host-side wrapper that copies compression output into a fresh Buffer before returning it to the guest.
- Migrate off vm2, which the maintainers have deprecated, toward an isolated process or isolated-vm for executing untrusted JavaScript.
- Restrict the set of builtins exposed to guest code to the minimum required by the application.
# Configuration example
npm install vm2@^3.12.2
npm ls vm2
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
