THREATOPS
THREAT OPS › Threat News › [GHSA] GHSA-v836-6xw4-9cx3 (high) — vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass

[GHSA] GHSA-v836-6xw4-9cx3 (high) — vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass

medgithub_advisoriesPublished 2026-08-17

GHSA-v836-6xw4-9cx3 Severity: high CVE: None

vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass

### Summary:

The `bufferAllocLimit` defense (GHSA-6785-pvv7-mvg7) can be completely bypassed using `ArrayBuffer`, `SharedArrayBuffer`, or any `TypedArray` constructor. These allocate identical host-process RSS through the same V8/libuv C++ allocation path as `Buffer.alloc` but are not subject

MITRE ATT&CK techniques

Original source: https://github.com/advisories/GHSA-v836-6xw4-9cx3