CVE-2026-63476

Name of the Vulnerable Software and Affected Versions isomorphic-git versions prior to 1.38.6

Description An issue exists when applying a packfile delta in src/utils/applyDelta.js where a server-controlled targetSize is passed without a bound to Buffer.alloc(targetSize). A malicious remote actor or a man-in-the-middle can send a delta header that forces git.clone() or git.fetch() to allocate approximately 2 GB of memory before the actual delta output is validated. Because GitPackIndex.fromPack() suppresses subsequent size-mismatch errors, systems with ample memory may experience resource waste, while containers, serverless functions, and small virtual machines may crash. This off-heap Buffer allocation is not mitigated by Node.js heap limits.

Recommendations Update to version 1.38.6.