{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-63476","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","state":"PUBLISHED","assignerShortName":"GitHub_M","dateReserved":"2026-07-16T21:37:45.769Z","datePublished":"2026-11-03T19:44:06.908Z","dateUpdated":"2026-11-03T19:44:06.908Z"},"containers":{"cna":{"title":"isomorphic-git: Unbounded memory allocation from attacker-controlled delta target size (DoS)","problemTypes":[{"descriptions":[{"cweId":"CWE-400","lang":"en","description":"CWE-400: Uncontrolled Resource Consumption","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-789","lang":"en","description":"CWE-789: Memory Allocation with Excessive Size Value","type":"CWE"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","version":"3.1"}}],"references":[{"name":"https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-9x82-4j54-863h","tags":["x_refsource_CONFIRM"],"url":"https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-9x82-4j54-863h"},{"name":"https://github.com/isomorphic-git/isomorphic-git/pull/2370","tags":["x_refsource_MISC"],"url":"https://github.com/isomorphic-git/isomorphic-git/pull/2370"},{"name":"https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b","tags":["x_refsource_MISC"],"url":"https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b"},{"name":"https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6","tags":["x_refsource_MISC"],"url":"https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6"}],"affected":[{"vendor":"isomorphic-git","product":"isomorphic-git","versions":[{"version":"< 1.38.6","status":"affected"}]}],"providerMetadata":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-11-03T19:44:06.908Z"},"descriptions":[{"lang":"en","value":"isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git reads a server-controlled targetSize while applying a packfile delta in src/utils/applyDelta.js and passes it without a bound to Buffer.alloc(targetSize). A malicious or man-in-the-middle-controlled remote can send one delta header that causes git.clone() or git.fetch() to allocate approximately 2 GB before validating the actual delta output. GitPackIndex.fromPack swallows the later size-mismatch error, so a host with sufficient memory may retain the resource waste without a visible failure, while containers, serverless functions, and small virtual machines may terminate. Node.js heap limits do not mitigate the off-heap Buffer allocation. This issue is fixed in version 1.38.6."}],"source":{"advisory":"GHSA-9x82-4j54-863h","discovery":"UNKNOWN"}}}}