CVE-2026-100723

vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant byteOffset === 0 and buffer.byteLength === length to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through NodeVM's builtin allowlist require: builtin: 'zlib' ,...

PT-2026-99450

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.12.2 Description The software fails to apply the Buffer backing-store ownership invariant to Buffers returned from host builtin modules. When the zlib module is exposed via the NodeVM builtin allowlist, the...