---
id: "CVE-2026-63476"
kind: "vulnerability"
aliases: ["CVE-2026-63476"]
title: "isomorphic-git: malicious remote can force 2 GB memory allocation during clone"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["browser", "containers", "isomorphic-git", "node.js", "package", "serverless"]
not_affected_if: ["no-clone-or-fetch", "trusted-remotes-only", "up-to-date-version"]
published_at: "2026-11-03T20:18:16+00:00"
first_seen_at: "2026-11-03T20:49:23+00:00"
updated_at: "2026-11-03T20:51:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63476", "first_seen_at": "2026-11-03T20:49:23+00:00"}]
---

# isomorphic-git: malicious remote can force 2 GB memory allocation during clone

isomorphic-git, a JavaScript Git library, trusts a size field from the remote server when applying packfile deltas, so a malicious or man-in-the-middle server can make a clone or fetch allocate about 2 GB of memory. The result is resource exhaustion that can crash containers, serverless functions, or small virtual machines.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `npm ls isomorphic-git` and compare it against the fixed version.
- Look for `isomorphic-git` in `package.json` and lockfiles, including transitive dependencies.
- Note whether the app clones or fetches from repositories it does not control.

## Fix

- `isomorphic-git` `1.38.6` and later

## Timeline

- 2026-11-03T20:49:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63476

## Documents

- [advisory] Vendor advisory: github.com https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-9x82-4j54-863h
- [fix] Patch: github.com https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b
- [fix] Release notes: github.com https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6

## From the sources

isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git reads a server-controlled targetSize while applying a packfile delta in src/utils/applyDelta.js and passes it without a bound to Buffer.alloc(targetSize). A malicious or man-in-the-middle-controlled remote can send one delta header that causes git.clone() or git.fetch() to allocate approximately 2 GB before validating the actual delta output. GitPackIndex.fromPack swallows the later size-mismatch error, so a host with sufficient memory may retain the resource waste without a visible failure, while containers, serverless functions, and small virtual machines may terminate. Node.js heap limits do not mitigate the off-heap Buffer allocation. This issue is fixed in version 1.38.6.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_