vm2: bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike

vm2: Sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks

vm2 3.10.0 through 3.11.7 Denial of Service via Host Promise

vm2 before 3.11.7 Sandbox Escape via CLI require

vm2: NodeVM network builtin exclusions bypass via internal _http_client and _http_server

vm2: Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain

vm2: Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)

vm2 before 3.11.7 Denylist Bypass via fs/promises

vm2: NodeVM require.root bypass via symlink traversal allows sandbox escape

vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool

vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit Bypass

vm2 before 3.11.7 Timeout Bypass via FinalizationRegistry

vm2: Host Process OOM DoS via Buffer.alloc (Timeout Bypass)

vm2 3.11.8 Sandbox Escape via crypto.setFips

vm2: sandbox boundary bypass via host Promise resolution preserving host object identity

vm2 before 3.11.8 allowAsync Bypass via Promise Thenable