CVE-2026-63476 Details

A denial-of-service vulnerability has been identified in isomorphic-git, a JavaScript implementation of Git for Node.js and browsers. The issue arises in versions prior to 1.38.6, where the application fails to properly validate a server-controlled 'targetSize' when applying packfile deltas. This oversight allows a malicious or man-in-the-middle-controlled remote to manipulate the delta header, causing the 'git.clone()' or 'git.fetch()' functions to allocate approximately 2 GB of memory before the actual delta output is validated. As a result, while hosts with sufficient memory may experience resource wastage without any visible errors, environments such as containers, serverless functions, and small virtual machines could be terminated due to memory constraints.

Users should update to isomorphic-git version 1.38.6 or later, where this vulnerability has been fixed.