NodeVM v3.11.0 Security Update: 13 RCE/DoS Fixes (GHSA-List)

Vulnerability Overview v3.11.0 release includes multiple security fixes and new features. Primarily addresses 13 security vulnerabilities involving various attack types such as Remote Code Execution (RCE), Information Disclosure, Denial of Service (DoS), etc. Introduces the option and method to enhance security. Impact Scope Affected Versions: Versions prior to v3.11.0. Affected Users: All developers using Node.js, especially those embedding and running untrusted code in sandboxed environments. Remediation Security Fixes 1. GHSA-grj5-jjm8-h35p - Description: Array self-return sandbox escape (RCE) - Fix: Resolved the sandbox escape issue caused by array self-return. 2. GHSA-v37h-5mfm-c47c - Description: Handler leakage via (RCE) - Fix: Resolved the handler leakage issue via . 3. GHSA-qgq4-v2jl-8j83 - Description: Handler leakage via forged target (RCE) - Fix: Resolved the handler leakage issue via forged target. 4. GHSA-47x8-96vw-5wg6 - Description: Cross-domain symbol extraction from host objects (RCE) - Fix: Resolved the cross-domain symbol extraction issue from host objects. 5. GHSA-55hx-92f6-fr95 - Description: Promise structure leakage / / cleanup (RCE) - Fix: Resolved the Promise structure leakage and related issues. 6. GHSA-wvpr-x96c-mhwq - Description: Host prototype pollution via bridge write trap (RCE) - Fix: Resolved the host prototype pollution issue via bridge write trap. 7. GHSA-947f-4v7f-x2v8 - Description: NodeVM built-in bypass via built-in (RCE) - Fix: Resolved the NodeVM built-in bypass issue via built-in. 8. GHSA-hw58-p9vx-2mjh - Description: Host process DoS due to unhandled rejection in Promise executor - Fix: Resolved the host process DoS issue caused by unhandled rejection in Promise executor. 9. GHSA-6785-pvv7-mvg7 - Description: Unbounded heap DoS - Fix: Resolved the heap DoS issue caused by unbounded . 10. GHSA-mp4h-4fx2-7cjg - Description: Host Promise / cleaner callback null prototype unwrapping (RCE) - Fix: Resolved the host Promise / cleaner callback null prototype unwrapping issue. 11. GHSA-v27j-qcj8-8rwr - Description: Call site frame information leakage via - Fix: Resolved the call site frame information leakage issue via . 12. GHSA-wp5r-2qw5-m7q7 - Description: Fast path bypass via / identifier transformer (RCE) - Fix: Resolved the fast path bypass issue via / identifier transformer. 13. GHSA-cp6q-6699-wx9r - Description: NodeVM symlink bypass (RCE) - Fix: Resolved the NodeVM symlink bypass issue. Other Fixes trace events: Added to the dangerous built-in blacklist, triggering C++ assertion to abort the host process. was: Added to the blacklist due to overly permissive experimental syscall surface (filesystem pre-mount, host clock/random, network), exposed by default. New Features bufferAllocLimit: Non-negative number or , limits series requests within the internal sandbox. Default is (fully backward compatible). Embedders should choose a finite value as part of layered DoS defense. FileSystem Contract: Added boundary check, normalizing candidate paths via , closing CWE-59 (symlinks pointing outside directories). Particularly useful for / / layouts where each entry is a symlink. Upgrade Notes Custom adapters: Must implement (or ) on a fully custom class. Otherwise, new will throw a at construction, referencing . Default users are unaffected. Embedders running untrusted asynchronous code: Should install a host-side handler. fixes the issue where synchronous executor throws but cannot reach the rejection path for async functions/async generators/await usage (V8 creates rejection promises via the realm's internal promise). See hardening recommendations. Embedders in memory-constrained environments: Should choose a finite (e.g., ). Documentation New README hardening recommendations section. docs/ATTACKS.md updated to category 24, with new defense invariants and category entry format sections. Full Changelog v3.10.5 - v3.11.0 Assets None

Goal Reached Thanks to every supporter — we hit 100%!

NodeVM v3.11.0 Security Update: 13 RCE/DoS Fixes (GHSA-List)

More from this source