CVE-2026-63475 Details
Description
isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git persists server-supplied circular symref= capabilities through updateRemoteRefs, and GitRefManager.resolve() follows the resulting loose symbolic references without a default depth limit or cycle detection. After a clone from a malicious or man-in-the-middle-controlled remote, operations such as log, status, checkout, and branch that resolve refs/remotes/origin/a or refs/remotes/origin/b do not terminate. The circular references remain on disk, leaving the repository unusable for the application and causing a persistent denial of service. This issue is fixed in version 1.38.6.
A denial-of-service vulnerability has been identified in isomorphic-git, a JavaScript implementation of Git for Node.js and browsers. This issue affects versions through 1.38.5. The vulnerability arises because the application improperly manages circular symbolic references (symrefs) received from a remote server. When a repository is cloned from a source that advertises these circular symrefs, subsequent operations that resolve certain references can enter an infinite loop, causing the application to hang indefinitely. The circular references are stored on disk, rendering the repository unusable until the references are manually cleared.
Users can upgrade to isomorphic-git version 1.38.6 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-96wc-2m84-2cj7 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b | [email protected] | Source CodeVendor |
| https://github.com/isomorphic-git/isomorphic-git/pull/2370 | [email protected] | Source CodeVendor |
| https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6 | [email protected] | Release NotesVendor |
| https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-96wc-2m84-2cj7 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-674 | Uncontrolled Recursion | [email protected] |
| CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| isomorphic-git | <= 1.38.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2026 | New CVE Received | [email protected] |