Live › vulnerability › CVE-2026-63475
isomorphic-git, a pure JavaScript Git library, saves circular symbolic ref entries sent by a remote server and then loops forever when resolving them. An attacker controlling a remote or a man-in-the-middle position can leave a cloned repository permanently unusable, a persistent denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 20:49 UTC. All times on this page are UTC.
Applications that use isomorphic-git to clone or read Git repositories from remote servers, especially ones that clone from untrusted or user-supplied URLs. Projects that only use Git through the system git binary, or never clone remote repositories, are not affected.
No product ranges from the sources yet.
npm ls isomorphic-git in each project that depends on it1.38.6Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git persists server-supplied circular symref= capabilities through updateRemoteRefs, and GitRefManager.resolve() follows the resulting loose symbolic references without a default depth limit or cycle detection. After a clone from a malicious or man-in-the-middle-controlled remote, operations such as log, status, checkout, and branch that resolve refs/remotes/origin/a or refs/remotes/origin/b do not terminate. The circular references remain on disk, leaving the repository unusable for the application and causing a persistent denial of service. This issue is fixed in version 1.38.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-63475")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.