NPM: vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool

NPM: vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.6...

CVE-2026-100723 vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool

vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant byteOffset === 0 and buffer.byteLength === length to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through NodeVM's builtin allowlist require: builtin: 'zlib' ,...

CVE-2026-100723 vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool

vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant byteOffset === 0 and buffer.byteLength === length to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through NodeVM's builtin allowlist require: builtin: 'zlib' ,...

GHSA-X5QG-8PQ6-39H6 Duplicate Advisory: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fcqc-726x-5wfc This link is maintained to preserve external references. Original Description vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by...

CVE-2026-92947: Exposure of Sensitive Information to an Unauthorized Actor

vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive dat...

CVE-2026-70634

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read in the Dictionary compression reverse row iterator tsl/src/compression/algorithms/dictionary.c. The forward path validates the decoded index; the reverse path uses an assertion compiled out of release builds,...