GHSA-9x82-4j54-863h: isomorphic-git: Unbounded memory allocation from attacker-controlled delta target size (DoS)
isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git reads a server-controlled targetSize while applying a packfile delta in src/utils/applyDelta.js and passes it without a bound to Buffer.alloc(targetSize). A malicious or man-in-the-middle-controlled remote can send one delta header that causes git.clone() or git.fetch() to allocate approximately 2 GB before validating the actual delta output. GitPackIndex.fromPack swallows the later size-mismatch error, so a host with sufficient memory may retain the resource waste without a visible failure, while containers, serverless functions, and small virtual machines may terminate. Node.js heap limits do not mitigate the off-heap Buffer allocation. This issue is fixed in version 1.38.6.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
isomorphic-gitto a version that resolves this vulnerability.Fixed in 1.38.6
Event History
Frequently Asked Questions
Which deployments are most exposed to service disruption?
Any application using isomorphic-git before 1.38.6 to clone or fetch from an attacker-controlled or man-in-the-middle-controlled remote is exposed. Containers, serverless functions, and small virtual machines are particularly likely to terminate because the malicious delta can trigger an allocation of about 2 GB.
Does an attacker need authentication or code execution on the affected host?
No. The vector is network-based and requires user interaction: the affected application must initiate git.clone() or git.fetch() against a malicious or intercepted remote. The attacker supplies a crafted packfile delta header; no host-side privileges are described.
Will Node.js heap limits prevent the memory exhaustion?
No. The allocation is made through Buffer.alloc(targetSize), which is off-heap, so Node.js heap limits do not mitigate it.
What should be done if upgrading cannot happen immediately?
Avoid cloning or fetching from untrusted remotes, and protect remote connections from man-in-the-middle interception. Where possible, run these operations with memory limits and isolation appropriate for a process that may attempt an approximately 2 GB allocation.
Can the affected operation appear to succeed despite the resource waste?
Yes. A later delta size-mismatch error is swallowed by GitPackIndex.fromPack, so systems with enough memory may retain the resource waste without a visible failure. Monitor memory consumption around clone and fetch operations, especially when processing untrusted remotes.