Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, sandboxed code can call Buffer.alloc() with an arbitrary size to allocate memory directly on the host heap. Because Buffer.alloc is a synchronous C++ native call, vm2's timeout option cannot interrupt it. A single request can exhaust host memory and crash the process with a FATAL ERROR: Reached heap limit. This vulnerability is fixed in 3.11.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨 HIGH severity CVE-2026-44004 (CVSS 7.5) vm2 sandbox for Node.js vulnerable to memory exhaustion via Buffer[.]alloc(). Attackers can crash host process remotely. Affected: vm2 <3.11.0 Fix: Update to 3.11.0 #CVE #Vulnerability #PatchNow https://t.co/DqZHKMCRaE
Post summary
A high‑severity vulnerability (CVE‑2026‑44004) in vm2 causes memory exhaustion and crashes; the recommended mitigation is to update to version 3.11.0.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | vm2_project | vm2 | - | node.js | - |