CVE-2026-63476

The isomorphic-git library (a JavaScript implementation of Git for Node.js and browsers) is vulnerable to a Denial of Service (DoS) attack in versions prior to 1.38.6 . The root cause is located in src/utils/applyDelta.js, where the application reads a server-controlled targetSize from a packfile...

CVE-2026-63476 isomorphic-git: Unbounded memory allocation from attacker-controlled delta target size (DoS)

isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git reads a server-controlled targetSize while applying a packfile delta in src/utils/applyDelta.js and passes it without a bound to Buffer.alloctargetSize. A malicious or...