CVE-2026-63475

Name of the Vulnerable Software and Affected Versions isomorphic-git versions prior to 1.38.6

Description The software persists server-supplied circular symref capabilities through updateRemoteRefs. The GitRefManager.resolve() function follows these loose symbolic references without a default depth limit or cycle detection. If a clone is performed from a malicious or man-in-the-middle-controlled remote, operations that resolve references such as refs/remotes/origin/a or refs/remotes/origin/b—including log, status, checkout, and branch—will not terminate. These circular references remain on disk, rendering the repository unusable and causing a persistent denial of service.

Recommendations Update to version 1.38.6.