CVE-2026-100723

{
  "etk_id": "ETK-2026-688",
  "cve_id": "CVE-2026-100723",
  "display_id": "CVE-2026-100723",
  "ghsa_id": "GHSA-43rv-jrfh-9mrr",
  "euvd_id": "EUVD-2026-87856",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Host buffer isolation failure in vm2 NodeVM",
  "summary": "vm2 before 3.12.2 can expose pooled host Buffer memory through NodeVM when an application permits the Node.js zlib builtin. Untrusted sandbox code may read sensitive data from neighboring host buffers and alter their contents. Exploitation requires the application to explicitly allowlist zlib for the guest.",
  "mitigation": "Upgrade vm2 to version 3.12.2 or later. Until upgraded, remove zlib from the NodeVM builtin allowlist for untrusted guests.",
  "vendor": "npm",
  "product": "npm:vm2",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 3.12.1"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "3.12.2"
      ],
      "package_name": "vm2",
      "purl": "pkg:npm/vm2"
    }
  ],
  "cwes": null,
  "cvss_score": 10,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
  "epss_score": 0.0032,
  "epss_percentile": 0.2306,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 13.3581908,
  "t0_at": "2026-09-27T01:28:30.027000+00:00",
  "signals": {
    "public_poc": {
      "at": "2026-10-05T23:00:46+00:00",
      "days": 8.897407094907408,
      "is_lower_bound": false,
      "measured_at": "2026-09-27T01:28:30.027000+00:00",
      "url": "https://github.com/advisories/GHSA-489w-w794-jq94"
    },
    "trigger_signal": {
      "at": "2026-09-27T01:28:30.027000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-27T01:28:30.027000+00:00",
      "url": "https://github.com/advisories/GHSA-489w-w794-jq94"
    }
  }
}