{"id":"CVE-2026-63475","kind":"vulnerability","aliases":["CVE-2026-63475"],"related":[],"title":"isomorphic-git: circular symrefs from a remote hang repository operations","description":"isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git persists server-supplied circular symref= capabilities through updateRemoteRefs, and GitRefManager.resolve() follows the resulting loose symbolic references without a default depth limit or cycle detection. After a clone from a malicious or man-in-the-middle-controlled remote, operations such as log, status, checkout, and branch that resolve refs/remotes/origin/a or refs/remotes/origin/b do not terminate. The circular references remain on disk, leaving the repository unusable for the application and causing a persistent denial of service. This issue is fixed in version 1.38.6.","summary":"isomorphic-git, a pure JavaScript Git library, saves circular symbolic ref entries sent by a remote server and then loops forever when resolving them. An attacker controlling a remote or a man-in-the-middle position can leave a cloned repository permanently unusable, a persistent denial of service.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","git","isomorphic-git","node","package"],"not_affected_if":["no-remote-clone","system-git-only"],"how_to_check":"- Check the installed version with `npm ls isomorphic-git` in each project that depends on it\n- Look for the library in any Node.js or browser app that clones repositories from remotes you do not fully control","fix":"- isomorphic-git: upgrade to `1.38.6`","status":"open","published_at":"2026-11-03T20:18:15+00:00","first_seen_at":"2026-11-03T20:49:23+00:00","triaged_at":"2026-11-03T20:52:01+00:00","updated_at":"2026-11-03T20:52:01+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-03T20:52:01Z","model":"claude-haiku-5-5","output":{"fix":"- isomorphic-git: upgrade to `1.38.6`","reach":"internet","title":"isomorphic-git: circular symrefs from a remote hang repository operations","impact":"low","summary":"isomorphic-git, a pure JavaScript Git library, saves circular symbolic ref entries sent by a remote server and then loops forever when resolving them. An attacker controlling a remote or a man-in-the-middle position can leave a cloned repository permanently unusable, a persistent denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["node","browser","isomorphic-git","git"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Repository operations hang permanently, leaving the clone unusable","analyst_note":"","how_to_check":"- Check the installed version with `npm ls isomorphic-git` in each project that depends on it\n- Look for the library in any Node.js or browser app that clones repositories from remotes you do not fully control","plain_action":"","needs_analyst":false,"not_affected_if":["no-remote-clone","system-git-only"],"who_is_affected":"Applications that use isomorphic-git to clone or read Git repositories from remote servers, especially ones that clone from untrusted or user-supplied URLs. Projects that only use Git through the system git binary, or never clone remote repositories, are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000686,"input_tokens":4300,"output_tokens":512,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-63475':14A,17A '1.38.6':91C,176C 'applic':162C 'attack':51B 'branch':141C 'browser':18B,88C 'capabl':101C 'caus':164C 'checkout':139C 'circular':4A,34B,99C,151C 'clone':66B,122C 'control':52B,132C 'cve':12A,15A 'cycl':118C 'default':114C 'denial':72B,167C 'depth':115C 'detect':119C 'disk':155C 'entri':37B 'fix':173C 'follow':106C 'forev':46B 'git':3A,19B,22B,27B,31B,77C,84C,94C 'gitrefmanager.resolve':105C 'hang':9A 'implement':82C 'isomorph':2A,21B,26B,76C,93C 'isomorphic-git':1A,20B,25B,75C,92C 'issu':171C 'javascript':30B,81C 'leav':64B,156C 'librari':32B 'limit':116C 'log':137C 'loop':45B 'loos':109C 'malici':125C 'man':58B,128C 'man-in-the-middl':57B 'man-in-the-middle-control':127C 'middl':61B,131C 'node':23B 'node.js':86C 'oper':11A,134C 'packag':24B 'perman':68B 'persist':71B,95C,166C 'posit':62B 'prior':89C 'pure':29B,80C 'ref':36B 'refer':111C,152C 'refs/remotes/origin/a':144C 'refs/remotes/origin/b':146C 'remain':153C 'remot':8A,41B,54B,133C 'repositori':10A,67B,158C 'resolv':48B,143C 'result':108C 'save':33B 'sent':38B 'server':42B,97C 'server-suppli':96C 'servic':74B,169C 'status':138C 'suppli':98C 'symbol':35B,110C 'symref':5A,100C 'termin':149C 'unus':69B,159C 'updateremoteref':103C 'version':175C 'without':112C","nicknames":[],"mitigations":[],"who_affected":"Applications that use isomorphic-git to clone or read Git repositories from remote servers, especially ones that clone from untrusted or user-supplied URLs. Projects that only use Git through the system git binary, or never clone remote repositories, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["browser","git","isomorphicgit","medium","node","package"],"campaign_type":null,"first_public_at":"2026-07-01T11:15:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63475","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63475","severity":null,"published_at":"2026-11-03T20:18:15+00:00","modified_at":"2026-11-03T20:18:16+00:00","first_seen_at":"2026-11-03T20:49:23+00:00","fetched_at":"2026-11-03T20:49:23+00:00","note":null}],"documents":[{"id":60576,"url":"https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":60577,"url":"https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":60600,"url":"https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-96wc-2m84-2cj7","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-01T11:15:38+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}