AIKIDO-2026-598108

TL;DR

When applying a packfile delta object, isomorphic-git reads an attacker-controlled targetSize and calls Buffer.alloc on it with no upper bound. A single malicious response to clone or fetch can declare a very large target size and force a multi-gigabyte allocation, exhausting memory and crashing the process on memory-constrained hosts. The subsequent size-mismatch error is swallowed, so the wasted allocation happens before any validation. The fix builds the delta result from the actual delta operations instead of pre-allocating the declared target size.