Read the docs
TI-2026-84491 Aliases CVE-2026-63476

Unbounded memory allocation in isomorphic-git delta handling

Priority MEDIUM 53CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-400.

Summary

isomorphic-git before 1.38.6 reads a server-controlled target size while applying a packfile delta and passes it without a bound to a buffer allocation (CWE-789). A malicious remote or man-in-the-middle can send one delta header that makes git.clone() or git.fetch() allocate about 2 GB before the delta is validated, which can exhaust memory in containers, serverless functions and small virtual machines.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git reads a server-controlled targetSize while applying a packfile delta in src/utils/applyDelta.js and passes it without a bound to Buffer.alloc(targetSize). A malicious or man-in-the-middle-controlled remote can send one delta header that causes git.clone() or git.fetch() to allocate approximately 2 GB before validating the actual delta output. GitPackIndex.fromPack swallows the later size-mismatch error, so a host with sufficient memory may retain the resource waste without a visible failure, while containers, serverless functions, and small virtual machines may terminate. Node.js heap limits do not mitigate the off-heap Buffer allocation. This issue is fixed in version 1.38.6.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00285 21st percentileScored 2026-11-07
Fix Partial isomorphic-git (isomorphic-git): 1.38.6Red Hat: 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
isomorphic-gitisomorphic-gitbefore 1.38.61.38.6Patch availableCNA
  • isomorphic-git Vendorisomorphic-git Affected before 1.38.6 Fixed in 1.38.6 Patch available CNA

Remediation

Upgrade isomorphic-git to version 1.38.6, which fixes this issue. Red Hat lists OpenShift Serverless, Red Hat Developer Hub 1 and Self-service automation portal 2 as affected, with no fix plan available.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

  • Fix · CNA isomorphic-git (isomorphic-git) Fixed in 1.38.6

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift ServerlessAffectedNo fix yet: Fix deferred
Red Hat Developer Hub 1AffectedNo fix yet: Fix deferred
Self-service automation portal 2AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-63476
  2. 2026-11-04 Affected versions changed · Red Hat
  3. 2026-11-04 CVSS score added · Red Hat
  4. 2026-11-07 CISA SSVC decision points changed
  5. 2026-11-07 Priority changed: LOW → MEDIUM

References

Other 4

  • TI-2026-84487 Path traversal in isomorphic-git checkout lets attackers write files CVSS 3.1HIGH 8.8
  • TI-2026-84492 isomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working directory on clone/checkout CVSS 3.1MEDIUM 5.3
  • TI-2026-84490 Circular symbolic refs hang ref resolution in isomorphic-git CVSS 3.1MEDIUM 4.3
  • TI-2021-06178 Server-side request forgery (SSRF) in @isomorphic-git/cors-proxy CVSS 3.1HIGH 8.6
  • TI-2026-60327 isomorphic-git < 1.42.0 Prototype Pollution via getRemoteInfo CVSS 4.0HIGH 7.1
  • TI-2021-10885 isomorphic-git before 1.8.2 allows Directory Traversal via a crafted repository. CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences