The vulnerability allows sandboxed code to invoke Buffer.alloc with an arbitrary size, allocating memory on the host heap. Because Buffer.alloc is a synchronous native call, the vm2 timeout mechanism cannot interrupt it, leading to uncontrolled memory consumption. A single malicious request can exhaust host memory and cause the Node.js process to crash with a FATAL ERROR, resulting in a denial‑of‑service.

This flaw affects all versions of the open‑source vm2 sandbox for Node.js preceding 3.11.0. The product is provided by patriksimek under the vm2 name.

The CVSS score is 7.5, indicating high impact with potential for significant disruption. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited publicly known exploitation. Based on the description, it is inferred that the attack vector involves delivering a crafted payload to an untrusted sandbox context that calls Buffer.alloc with a large size; no authentication or privileged access is required beyond normal sandbox usage.