CVE-2026-63475 isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)

isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git persists server-supplied circular symref= capabilities through updateRemoteRefs, and GitRefManager.resolve follows the resulting loose symbolic references without a default depth...