{"affected":[{"product":"isomorphic-git","source":"CNA: GitHub_M","vendor":"isomorphic-git","versions":[{"status":"affected","version":"< 1.38.6"}]}],"cveId":"CVE-2026-63476","cwes":["CWE-400","CWE-789"],"description":"isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git reads a server-controlled targetSize while applying a packfile delta in src/utils/applyDelta.js and passes it without a bound to Buffer.alloc(targetSize). A malicious or man-in-the-middle-controlled remote can send one delta header that causes git.clone() or git.fetch() to allocate approximately 2 GB before validating the actual delta output. GitPackIndex.fromPack swallows the later size-mismatch error, so a host with sufficient memory may retain the resource waste without a visible failure, while containers, serverless functions, and small virtual machines may terminate. Node.js heap limits do not mitigate the off-heap Buffer allocation. This issue is fixed in version 1.38.6.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":4.3,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","version":"3.1"}],"modifiedAt":1793735046908,"publishedAt":1793735046908,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-9x82-4j54-863h"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/isomorphic-git/isomorphic-git/pull/2370"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6"}],"remediation":[],"revision":"ea8b42acba0fbde747b13058837a4c8703204956f37516b9e5d74b7f2896ad6a","sources":[{"modifiedAt":1793735046908,"name":"CNA: GitHub_M","retrievedAt":1793736600425,"url":"https://www.cve.org/CVERecord?id=CVE-2026-63476"}],"ssvc":null,"status":"published","title":"isomorphic-git: Unbounded memory allocation from attacker-controlled delta target size (DoS)","updatedAt":1793736600425}