JavaScript Git Library Vulnerability in isomorphic-git Affecting Node.js and Browsers

CVE-2026-63476

What is CVE-2026-63476?

isomorphic-git, a pure JavaScript implementation of Git utilized in Node.js and browser environments, has a critical vulnerability in versions prior to 1.38.6. The library inadequately reads a server-controlled target size while processing a packfile delta, allowing a malicious actor or man-in-the-middle to exploit the git.clone() or git.fetch() functions. This flaw causes excessive memory allocation, potentially up to 2 GB, without validating the actual delta output. As the GitPackIndex.fromPack method fails to handle size-mismatch errors, systems with sufficient memory may experience resource waste without visible failure, while constrained environments like containers or serverless functions could crash. The issue remains unresolved at the heap allocation level, which is not mitigated by Node.js heap limits. Users are advised to upgrade to version 1.38.6 or later to safeguard their systems.

References