npm/vm2 CVE-2026-100723: critical 10, EPSS 0.32%

vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary

Action: Upgrade vm2 to 3.12.2 or later.

npm i vm2@3.12.2

Affected

Fixed versions

Sources

• osv: GHSA-489w-w794-jq94
• https://github.com/patriksimek/vm2/security/advisories/GHSA-489w-w794-jq94
• https://github.com/patriksimek/vm2/commit/4f2508abeb252aa86eb6761c78b3b000248fb089
• https://github.com/patriksimek/vm2/commit/5214b02ef13b82497fcb917b45320dfd014ffd09
• https://github.com/patriksimek/vm2/commit/9596bf5e7d8de7351d675ff4f5293b72157202d4
• https://github.com/patriksimek/vm2
• https://github.com/patriksimek/vm2/releases/tag/v3.12.2
• https://www.vulncheck.com/advisories/vm2-before-3.12.2-memory-disclosure-via-zlib-buffer-pool

CVE-2026-100723 · published 2026-10-05T23:00:46Z · modified 2026-10-05T23:15:04.002769867Z · JSON