{"id":"CVE-2026-63476","kind":"vulnerability","aliases":["CVE-2026-63476"],"related":[],"title":"isomorphic-git: malicious remote can force 2 GB memory allocation during clone","description":"isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git reads a server-controlled targetSize while applying a packfile delta in src/utils/applyDelta.js and passes it without a bound to Buffer.alloc(targetSize). A malicious or man-in-the-middle-controlled remote can send one delta header that causes git.clone() or git.fetch() to allocate approximately 2 GB before validating the actual delta output. GitPackIndex.fromPack swallows the later size-mismatch error, so a host with sufficient memory may retain the resource waste without a visible failure, while containers, serverless functions, and small virtual machines may terminate. Node.js heap limits do not mitigate the off-heap Buffer allocation. This issue is fixed in version 1.38.6.","summary":"isomorphic-git, a JavaScript Git library, trusts a size field from the remote server when applying packfile deltas, so a malicious or man-in-the-middle server can make a clone or fetch allocate about 2 GB of memory. The result is resource exhaustion that can crash containers, serverless functions, or small virtual machines.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","containers","isomorphic-git","node.js","package","serverless"],"not_affected_if":["no-clone-or-fetch","trusted-remotes-only","up-to-date-version"],"how_to_check":"- Check the installed version with `npm ls isomorphic-git` and compare it against the fixed version.\n- Look for `isomorphic-git` in `package.json` and lockfiles, including transitive dependencies.\n- Note whether the app clones or fetches from repositories it does not control.","fix":"- `isomorphic-git` `1.38.6` and later","status":"open","published_at":"2026-11-03T20:18:16+00:00","first_seen_at":"2026-11-03T20:49:23+00:00","triaged_at":"2026-11-03T20:51:55+00:00","updated_at":"2026-11-03T20:51:55+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-03T20:51:55Z","model":"claude-haiku-5-5","output":{"fix":"- `isomorphic-git` `1.38.6` and later","reach":"network","title":"isomorphic-git: malicious remote can force 2 GB memory allocation during clone","impact":"low","summary":"isomorphic-git, a JavaScript Git library, trusts a size field from the remote server when applying packfile deltas, so a malicious or man-in-the-middle server can make a clone or fetch allocate about 2 GB of memory. The result is resource exhaustion that can crash containers, serverless functions, or small virtual machines.","audience":"developers","category":"package","nicknames":[],"who_cares":["isomorphic-git","node.js","browser","serverless","containers"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"remote server exhausts memory and crashes the host process","analyst_note":"","how_to_check":"- Check the installed version with `npm ls isomorphic-git` and compare it against the fixed version.\n- Look for `isomorphic-git` in `package.json` and lockfiles, including transitive dependencies.\n- Note whether the app clones or fetches from repositories it does not control.","plain_action":"","needs_analyst":false,"not_affected_if":["trusted-remotes-only","no-clone-or-fetch","up-to-date-version"],"who_is_affected":"Applications that use isomorphic-git to clone or fetch from remote Git servers, especially when the remote is untrusted or reachable through a man-in-the-middle position. Containers, serverless functions, and small VMs with limited memory are most likely to crash. Projects that only use it on fully trusted local repositories can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000732,"input_tokens":4345,"output_tokens":594,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-63476':16A,19A '1.38.6':100C,208C '2':8A,65B,149C 'actual':154C 'alloc':11A,63B,147C,201C 'appli':44B,111C 'approxim':148C 'bound':122C 'browser':20B,97C 'buffer':200C 'buffer.alloc':124C 'caus':142C 'clone':13A,60B 'contain':21B,77B,181C 'control':108C,134C 'crash':76B 'cve':14A,17A 'delta':46B,114C,139C,155C 'error':164C 'exhaust':73B 'failur':179C 'fetch':62B 'field':38B 'fix':205C 'forc':7A 'function':79B,183C 'gb':9A,66B,150C 'git':3A,24B,30B,33B,86C,93C,103C 'git.clone':143C 'git.fetch':145C 'gitpackindex.frompack':157C 'header':140C 'heap':191C,199C 'host':167C 'implement':91C 'isomorph':2A,23B,29B,85C,102C 'isomorphic-git':1A,22B,28B,84C,101C 'issu':203C 'javascript':32B,90C 'later':160C 'librari':34B 'limit':192C 'machin':83B,187C 'make':58B 'malici':4A,49B,127C 'man':52B,130C 'man-in-the-middl':51B 'man-in-the-middle-control':129C 'may':171C,188C 'memori':10A,68B,170C 'middl':55B,133C 'mismatch':163C 'mitig':195C 'node.js':25B,95C,190C 'off-heap':197C 'one':138C 'output':156C 'packag':26B 'packfil':45B,113C 'pass':118C 'prior':98C 'pure':89C 'read':104C 'remot':5A,41B,135C 'resourc':72B,174C 'result':70B 'retain':172C 'send':137C 'server':42B,56B,107C 'server-control':106C 'serverless':27B,78B,182C 'size':37B,162C 'size-mismatch':161C 'small':81B,185C 'src/utils/applydelta.js':116C 'suffici':169C 'swallow':158C 'targets':109C,125C 'termin':189C 'trust':35B 'valid':152C 'version':207C 'virtual':82B,186C 'visibl':178C 'wast':175C 'without':120C,176C","nicknames":[],"mitigations":[],"who_affected":"Applications that use isomorphic-git to clone or fetch from remote Git servers, especially when the remote is untrusted or reachable through a man-in-the-middle position. Containers, serverless functions, and small VMs with limited memory are most likely to crash. Projects that only use it on fully trusted local repositories can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["browser","containers","isomorphicgit","medium","nodejs","package","serverless"],"campaign_type":null,"first_public_at":"2026-07-01T11:16:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63476","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63476","severity":null,"published_at":"2026-11-03T20:18:16+00:00","modified_at":"2026-11-03T20:18:16+00:00","first_seen_at":"2026-11-03T20:49:23+00:00","fetched_at":"2026-11-03T20:49:23+00:00","note":null}],"documents":[{"id":60576,"url":"https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":60577,"url":"https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":60603,"url":"https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-9x82-4j54-863h","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-01T11:16:14+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}