Improper Restriction of Operations within the Bounds of a Memory Buffer
ethereumjs-vm allows attackers to cause a denial of service (vm.runCode failure and REVERT) via a code: Buffer.from(my_code, 'hex') attribute.
Advisories for Npm/Ethereumjs-Vm package
2018