CVE-2026-63475
Deferred Deferred - Pending Action

Infinite Loop in isomorphic-git Due to Unbounded Symref Resolution

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: GitHub, Inc.

Description
isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git persists server-supplied circular symref= capabilities through updateRemoteRefs, and GitRefManager.resolve() follows the resulting loose symbolic references without a default depth limit or cycle detection. After a clone from a malicious or man-in-the-middle-controlled remote, operations such as log, status, checkout, and branch that resolve refs/remotes/origin/a or refs/remotes/origin/b do not terminate. The circular references remain on disk, leaving the repository unusable for the application and causing a persistent denial of service. This issue is fixed in version 1.38.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-63475
EUVD
EUVD-2026-116273

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
isomorphic-git isomorphic-git < 1.38.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-835 The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-63475 is a vulnerability in the isomorphic-git library affecting versions 1.38.5 and earlier. It allows a malicious server to cause a persistent denial of service by creating circular symbolic references. When isomorphic-git clones a repository from an untrusted server, it writes these circular references to disk without validation. Subsequent Git operations like log, status, or checkout hang indefinitely because the software follows the circular references without cycle detection or depth limits.

Detection Guidance

Check if your system uses isomorphic-git version 1.38.5 or earlier. Run: npm list isomorphic-git. If vulnerable, update to version 1.38.6 or later immediately.

Inspect Git repositories for circular symbolic references in .git/refs/remotes/origin/. Look for files where references point to each other in a loop.

Impact Analysis

If you use isomorphic-git versions 1.38.5 or earlier and clone from an untrusted or compromised server, your repository may become unusable. Any Git operation that resolves references will hang forever, effectively bricking the repository. The circular references persist on disk, so the issue remains even after restarting the application.

Mitigation Strategies

Upgrade isomorphic-git to version 1.38.6 or later. Run: npm update isomorphic-git. Remove any existing circular symrefs manually if repositories are already affected.

Avoid cloning from untrusted or suspicious remote repositories until the update is applied. Monitor for hanging Git operations that may indicate exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63475. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...