isomorphic-git CVE-2026-63476

Exploitation requires that the target application call isomorphic-git's git.clone() or git.fetch() against a remote the attacker controls or can intercept (man-in-the-middle); the attacker then sends one packfile containing an OBJ_REF_DELTA whose delta header declares an oversized targetSize (e.g. 0x7FFFFFFF ≈ 2 GB), which src/utils/applyDelta.js passes directly to Buffer.alloc with no upper bound before validating the actual delta output. No authentication is needed (PR:N) and no special isomorphic-git configuration is required - default clone/fetch behavior is affected. Limiting factors: the attack needs the victim to initiate the fetch/clone against the malicious or intercepted endpoint (UI:R), and impact depends on host memory - containers, serverless functions, and small VMs are OOM-killed, whereas hosts with ample RAM only incur a silent ~2 GB transient waste (the size-mismatch error is swallowed in GitPackIndex.fromPack) rather than a crash. Node.js --max-old-space-size heap limits do not mitigate it because the allocation is off-heap.

This is a genuine but moderate-priority issue, correctly rated low-to-medium (CVSS 4.3). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L is internally consistent with the mechanism: network-reachable, no authentication (PR:N), low complexity, but requiring user interaction (UI:R) because the victim application must initiate git.clone()/git.fetch() against a malicious or MitM-controlled remote. Impact is availability-only (C:N/I:N/A:L) - a denial of service via ~2 GB off-heap Buffer.alloc from an attacker-controlled targetSize, with no code execution or data exposure. The vuln.today decision label is 'this_month' (not act_now/emergency), aligning with the modest severity. No CISA KEV entry and no EPSS score were provided in the input, so there is no confirmed active exploitation and no modeled exploitation probability to weigh; absence of these signals is not evidence of safety but does not elevate priority. A public PoC reference exists (spiceoverflow/av4-oom) that reports confirmed OOM allocation under a 256 MB heap cap, which demonstrates the defect is practically triggerable. Net assessment: a real, exploit-demonstrated DoS worth patching on a normal cadence, most meaningful for services that clone/fetch from untrusted remotes on memory-constrained infrastructure; not a drop-everything emergency given availability-only impact and the required user-initiated fetch.

An application (for example a CI job, webhook handler, or serverless function) performs git.clone() or git.fetch() with isomorphic-git against a remote that is attacker-controlled or intercepted via man-in-the-middle. The server returns a single packfile whose OBJ_REF_DELTA header declares targetSize = 0x7FFFFFFF, forcing Buffer.alloc(~2 GB) before the delta output is validated. On a container, serverless function, or small VM the OS SIGKILLs the process (DoS); a public PoC reference (spiceoverflow/av4-oom) reports a confirmed ~2048 MB external allocation during clone.