The vulnerability allows code executed within the vm2 sandbox to bypass the configured buffer allocation limit set in lib/setup-sandbox.js. By using Buffer.concat(list,totalLength) or Buffer.from(arrayLike) with an attacker‑controlled length, sandbox code can request large synchronous allocations of host memory. This can exhaust the host process and lead to denial of service. The weakness is a classic Resource Exhaustion flaw identified as CWE‑770.

The affected product is vm2, an open‑source sandbox for Node.js maintained by patriksimek. All released versions prior to 3.11.6 are impacted; version 3.11.6 and later contain the fix.

The CVSS score of 8.7 indicates a high severity issue, and the vulnerability is not listed in the CISA KEV catalog. EPSS data is unavailable. The likely attack vector is the execution of malicious code inside the vm2 sandbox, where an attacker can supply large arrayLike or totalLength values to trigger the overflow. Since the exploit requires code inside the sandbox, it is a local‑context attack and does not require an external network connection. Successful exploitation can saturate process memory and cause the host Node.js process to terminate or become unresponsive.