Skip to content
OpenAdvisories

Vendor

isomorphic-git

5 known vulnerabilities.

Products

isomorphic-git 5
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-63475

    isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)

    isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git persists server-supplied circular symref= capabilities through updateRemoteRefs, and GitRefManager.resolve() follows the resulting loose symbol…

    isomorphic-git isomorphic-git
  • Medium 4.3
    CVE-2026-63476

    isomorphic-git: Unbounded memory allocation from attacker-controlled delta target size (DoS)

    isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git reads a server-controlled targetSize while applying a packfile delta in src/utils/applyDelta.js and passes it without a bound to Buffer.alloc(t…

    isomorphic-git isomorphic-git
  • Medium 5.3
    CVE-2026-63478

    isomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working directory on clone/checkout

    isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's tree parser in src/models/GitTree.js accepts a standalone .. tree-entry name because it rejects only path separators. During clone or checkou…

    isomorphic-git isomorphic-git