CVE-2026-63475: isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)

Published Nov 3, 2026

Updated

isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git persists server-supplied circular symref= capabilities through updateRemoteRefs, and GitRefManager.resolve() follows the resulting loose symbolic references without a default depth limit or cycle detection. After a clone from a malicious or man-in-the-middle-controlled remote, operations such as log, status, checkout, and branch that resolve refs/remotes/origin/a or refs/remotes/origin/b do not terminate. The circular references remain on disk, leaving the repository unusable for the application and causing a persistent denial of service. This issue is fixed in version 1.38.6.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade isomorphic-git to a version that resolves this vulnerability.
Fixed in 1.38.6

Event History

Nov 3, 2026

CVE Published

via MITRE·07:45 PM

Data Sourced

via MITRE·07:45 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are realistically exposed?

Applications using isomorphic-git versions before 1.38.6 that clone from a malicious remote, or from a remote controlled by a man-in-the-middle attacker, are exposed. The affected repository can remain unusable because the malicious symbolic references are persisted on disk.

What does an attacker need to do to trigger the denial of service?

The attacker needs to supply circular symref capabilities during a clone, either by operating the remote or controlling the connection as a man-in-the-middle. No credentials are required, but user interaction is required to clone from the attacker-controlled or intercepted remote.

How can I tell whether a repository is already affected?

Operations that resolve the affected remote-tracking references, including log, status, checkout, or branch, fail to terminate after cloning. The problematic references may be refs/remotes/origin/a or refs/remotes/origin/b and persist locally.

What should be done if immediate upgrading is not possible?

Avoid cloning from untrusted remotes or connections that could be subject to man-in-the-middle control. For repositories already affected, the circular symbolic references must be removed or the repository replaced, since they remain on disk.

CVE-2026-63475: isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)

Remediation

Event History

Frequently Asked Questions

Which deployments are realistically exposed?

What does an attacker need to do to trigger the denial of service?

How can I tell whether a repository is already affected?

What should be done if immediate upgrading is not possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are realistically exposed?

What does an attacker need to do to trigger the denial of service?

How can I tell whether a repository is already affected?

What should be done if immediate upgrading is not possible?