CVE-2026-100723
1 advisory.
npm/vm2 CVE-2026-100723: critical 10
vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary
Action: Upgrade vm2 to 3.12.2 or later.
npm i vm2@3.12.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.12.2 | - |
Fixed versions
| 3.12.2 |
Sources
- osv: GHSA-489w-w794-jq94
- https://github.com/patriksimek/vm2/security/advisories/GHSA-489w-w794-jq94
- https://github.com/patriksimek/vm2/commit/4f2508abeb252aa86eb6761c78b3b000248fb089
- https://github.com/patriksimek/vm2/commit/5214b02ef13b82497fcb917b45320dfd014ffd09
- https://github.com/patriksimek/vm2/commit/9596bf5e7d8de7351d675ff4f5293b72157202d4
- https://github.com/patriksimek/vm2
- https://github.com/patriksimek/vm2/releases/tag/v3.12.2
- https://www.vulncheck.com/advisories/vm2-before-3.12.2-memory-disclosure-via-zlib-buffer-pool
CVE-2026-100723 · published · modified · JSON