The vm2 sandbox library for Node.js contains a resource allocation vulnerability that can be leveraged by an unauthenticated attacker to cause a denial of service.

This is a resource allocation vulnerability (CWE-770) where the software fails to properly limit or throttle resources, allowing an unauthenticated attacker to trigger excessive consumption.

An attacker can exploit this vulnerability to exhaust system resources, resulting in a denial of service for applications relying on the vm2 sandbox. This can lead to significant service disruption and downtime for any web services or internal tools utilizing this library. The CVSS score of 8.7 highlights the severity of this availability risk.

Immediate Action: Update the vm2 dependency to version 3.11.6 or later to enforce proper resource limits.

Proactive Monitoring: Monitor CPU and memory usage patterns for Node.js applications to identify potential resource exhaustion attacks.

Compensating Controls: Implement rate limiting and resource quotas at the application or container level to restrict the impact of potential sandbox escapes or exhaustion attempts.

Public Exploit Available: No (exploit_available: false)

Organizations using the vm2 sandbox library should perform an immediate audit of their dependencies and update to the patched version. Ensuring that the sandbox is correctly configured with resource limits is essential to maintaining service availability.