Live › vulnerability › CVE-2026-63476
isomorphic-git, a JavaScript Git library, trusts a size field from the remote server when applying packfile deltas, so a malicious or man-in-the-middle server can make a clone or fetch allocate about 2 GB of memory. The result is resource exhaustion that can crash containers, serverless functions, or small virtual machines.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 20:49 UTC. All times on this page are UTC.
Applications that use isomorphic-git to clone or fetch from remote Git servers, especially when the remote is untrusted or reachable through a man-in-the-middle position. Containers, serverless functions, and small VMs with limited memory are most likely to crash. Projects that only use it on fully trusted local repositories can skip it.
No product ranges from the sources yet.
npm ls isomorphic-git and compare it against the fixed version.isomorphic-git in package.json and lockfiles, including transitive dependencies.isomorphic-git 1.38.6 and laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git reads a server-controlled targetSize while applying a packfile delta in src/utils/applyDelta.js and passes it without a bound to Buffer.alloc(targetSize). A malicious or man-in-the-middle-controlled remote can send one delta header that causes git.clone() or git.fetch() to allocate approximately 2 GB before validating the actual delta output. GitPackIndex.fromPack swallows the later size-mismatch error, so a host with sufficient memory may retain the resource waste without a visible failure, while containers, serverless functions, and small virtual machines may terminate. Node.js heap limits do not mitigate the off-heap Buffer allocation. This issue is fixed in version 1.38.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-63476")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.