CVE•Published 2026-05-13•Modified 2026-10-26•0 articles on news•5 live references•NVD data

CVE-2026-44004Vm2_project · Vm2

Vulnerability data via NVD (ingested)

CVSS v3.1

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS percentile

Exploit Prediction Scoring System · top 49% of all CVEs

Weaknesses (CWE)

CWE-770Allocation of Resources Without Limits or Throttling CWE-1285Improper Validation of Specified Index, Position, or Offset in Input

Description

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, sandboxed code can call Buffer.alloc() with an arbitrary size to allocate memory directly on the host heap. Because Buffer.alloc is a synchronous C++ native call, vm2's timeout option cannot interrupt it. A single request can exhaust host memory and crash the process with a FATAL ERROR: Reached heap limit. This vulnerability is fixed in 3.11.0.

Timeline

Published 2026-05-13

Modified 2026-10-26

External references

NVD MITRE GitHub PoC trickest/cve VulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).

Shodan · vuln tag0 hosts

vuln:CVE-2026-44004

Hosts Shodan has explicitly fingerprinted as vulnerable.

Shodan · product

product:"Vm2 Project Vm2"

All exposed Vm2 Project Vm2 instances — cross-reference with the CVE's affected-version range.

Shodan · banner/body mention

http.html:"Vm2"

HTTP body or banner mentions "Vm2" — catches deploys Shodan didn't identify as a product.

More intel sources (5)

Shodan report

vuln:CVE-2026-44004