Allocation of Resources Without Limits or Throttling Affecting isomorphic-git package, versions <1.38.6
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Allocation of Resources Without Limits or Throttling vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-JS-ISOMORPHICGIT-22193065
- published4 Nov 2026
- disclosed3 Nov 2026
- creditMo Sakr
Introduced: 3 Nov 2026
NewCVE-2026-63476 (opens in a new tab)How to fix?
Upgrade isomorphic-git to version 1.38.6 or higher.
Overview
isomorphic-git is a pure JavaScript reimplementation of git that works in both Node.js and browser JavaScript environments. It can read and write to git repositories, fetch from and push to git remotes (such as GitHub), all without any native C++ module dependencies.
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via applyDelta in src/utils/applyDelta.js, which reads a server-controlled targetSize from a packfile delta header and passes it directly to Buffer.alloc(targetSize) with no upper bound. A malicious or MitM-controlled remote can send a single delta header declaring a targetSize of approximately 2 GB, causing git.clone() or git.fetch() to perform that allocation before any validation of the actual delta output. Because GitPackIndex.fromPack swallows the subsequent size-mismatch error, hosts with sufficient memory silently waste the allocated resource, while memory-constrained environments such as containers, serverless functions, and small virtual machines are terminated by the OS. The allocation is off-heap, so Node.js heap limits do not mitigate it.
PoC
https://github.com/spiceoverflow/av4-oom — open in a Codespace; a single clone/fetch against the bundled server, run under --max-old-space-size=256:
[AV-4] *** OOM ALLOCATION CONFIRMED — Buffer.alloc(targetSize) RAN ***
[AV-4] External (Buffer) memory rose by 2048 MB during clone.
(The allocation is off-heap, so a Node heap cap does not mitigate it.)
Note: The PoC states it should be run in a Codespace against a bundled server with Node.js flag --max-old-space-size=256.