CVE-2026-44004 Overview
CVE-2026-44004 affects vm2, an open source virtual machine and sandbox library for Node.js. Sandboxed code running in vm2 versions prior to 3.11.0 can invoke Buffer.alloc() with an arbitrary size to allocate memory directly on the host heap. Because Buffer.alloc executes as a synchronous C++ native call, vm2's timeout option cannot interrupt the allocation. A single request can exhaust host memory and terminate the Node.js process with FATAL ERROR: Reached heap limit. The vendor vm2_project addressed the issue in vm2 3.11.0. The flaw maps to CWE-770: Allocation of Resources Without Limits or Throttling.
Critical Impact
Unauthenticated, network-reachable attackers submitting untrusted JavaScript to a vm2 sandbox can crash the host Node.js process, producing a denial-of-service condition against any service that evaluates user-supplied code.
Affected Products
- vm2 versions prior to 3.11.0
- Node.js applications embedding vm2 for untrusted code evaluation
- Server-side platforms using vm2 for plugin or expression sandboxing
Discovery Timeline
- 2026-05-13 - CVE-2026-44004 published to NVD
- 2026-05-14 - Last updated in NVD database
Technical Details for CVE-2026-44004
Vulnerability Analysis
vm2 provides a sandbox intended to execute untrusted JavaScript with limits including a timeout option that aborts long-running script execution. The sandbox exposes a Buffer constructor that delegates to the host's native Buffer.alloc() implementation. Buffer.alloc() is implemented in C++ and runs synchronously on the main thread, so the V8 interrupt mechanism that backs the timeout option cannot preempt it. Sandboxed code that calls Buffer.alloc(verylarge) therefore commits the host process to a single, uninterruptible allocation. When the requested size exceeds available heap capacity, the Node.js runtime aborts with FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory, terminating the entire process and any in-flight requests it served.
Root Cause
The root cause is unbounded resource allocation [CWE-770]. vm2 permits sandboxed code to pass attacker-controlled size arguments to a native allocation primitive without enforcing an upper bound or running the allocation under an interruptible boundary. The timeout control covers JavaScript execution but does not constrain memory consumed by native bindings.
Attack Vector
Exploitation requires only the ability to submit JavaScript to a service that evaluates it inside vm2. The attacker supplies a payload that calls Buffer.alloc() with a size large enough to exceed the configured Node.js heap. No authentication, user interaction, or local access is required when the sandboxed evaluation endpoint is exposed over the network. A single crafted request is sufficient to crash the host process.
No public proof-of-concept exploit is referenced in the advisory, and the vulnerability is described in prose form in the vm2 GitHub Security Advisory GHSA-6785-pvv7-mvg7.
Detection Methods for CVE-2026-44004
Indicators of Compromise
- Node.js process termination logs containing FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory.
- Sudden, sharp resident set size (RSS) growth in Node.js workers immediately preceding a crash.
- Repeated service restarts or container OOMKilled events correlated with traffic to endpoints that evaluate user-supplied scripts.
Detection Strategies
- Inventory Node.js applications and identify any dependency on vm2 below version 3.11.0 using npm ls vm2 or software composition analysis tooling.
- Inspect sandbox input logs for JavaScript payloads referencing Buffer.alloc, Buffer.allocUnsafe, or large numeric size arguments.
- Correlate process crash events with upstream request logs to identify the originating client and payload.
Monitoring Recommendations
- Alert on Node.js heap usage approaching the configured --max-old-space-size limit.
- Monitor process uptime and restart frequency for services that host vm2 sandboxes.
- Capture standard error output from Node.js workers so heap-limit fatal errors are retained for triage.
How to Mitigate CVE-2026-44004
Immediate Actions Required
- Upgrade vm2 to version 3.11.0 or later in all Node.js projects that depend on it.
- Audit transitive dependencies, because vm2 is frequently embedded in higher-level sandboxing or templating libraries.
- Restrict network exposure of endpoints that evaluate untrusted JavaScript until the upgrade is deployed.
Patch Information
The vendor fixed CVE-2026-44004 in vm2 3.11.0. Update the dependency by running npm install vm2@^3.11.0 or the equivalent for your package manager and redeploy affected services. Review the vm2 GitHub Security Advisory GHSA-6785-pvv7-mvg7 for vendor guidance. Note that the vm2 project has been deprecated by its maintainer; teams should also plan migration to an actively maintained sandboxing approach such as isolated-vm or out-of-process execution.
Workarounds
- Set --max-old-space-size low enough that a single allocation cannot crash a shared host, and isolate vm2 workloads in child processes that can be restarted without impacting the parent.
- Wrap sandboxed evaluation in a worker thread or child process with strict memory limits enforced by the operating system (for example, cgroups memory.max or container memory limits).
- Pre-filter submitted scripts to reject calls to Buffer.alloc, Buffer.allocUnsafe, and other native allocation primitives until patched code is in production.
# Configuration example
npm install vm2@^3.11.0
node --max-old-space-size=256 server.js
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
