CVE-2026-63475

isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git persists server-supplied circular symref= capabilities through updateRemoteRefs, and GitRefManager.resolve follows the resulting loose symbolic references without a default depth...

EUVD-2026-116273

isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git persists server-supplied circular symref= capabilities through updateRemoteRefs, and GitRefManager.resolve follows the resulting loose symbolic references without a default depth...

CVE-2026-63475

The isomorphic-git library (a JavaScript Git implementation for Node.js and browsers) is vulnerable to a Denial of Service (DoS) via circular symbolic references. Prior to version 1.38.6 , the updateRemoteRefs function persists server-supplied circular symref= capabilities. Because GitRefManager....

CVE-2026-63475 isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)

isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git persists server-supplied circular symref= capabilities through updateRemoteRefs, and GitRefManager.resolve follows the resulting loose symbolic references without a default depth...