EUVD-2026-116273

isomorphic-git: Circular symbolic references cause non-terminating resolution DoS...

GHSA-96WC-2M84-2CJ7 isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)

Summary A malicious server can advertise circular symref= capabilities e.g. a → b and b → a. isomorphic-git writes them to disk as loose symrefs, and GitRefManager.resolve follows them with no depth limit and no cycle detection, so any later operation that resolves one of them log, status,...

isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)

Summary A malicious server can advertise circular symref= capabilities e.g. a → b and b → a. isomorphic-git writes them to disk as loose symrefs, and GitRefManager.resolve follows them with no depth limit and no cycle detection, so any later operation that resolves one of them log, status,...

CVE-2026-63475

isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git persists server-supplied circular symref= capabilities through updateRemoteRefs, and GitRefManager.resolve follows the resulting loose symbolic references without a default depth...

Infinite loop

Overview isomorphic-git is a pure JavaScript reimplementation of git that works in both Node.js and browser JavaScript environments. It can read and write to git repositories, fetch from and push to git remotes such as GitHub, all without any native C++ module dependencies. Affected versions of...

CVE-2026-63475

isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git persists server-supplied circular symref= capabilities through updateRemoteRefs, and GitRefManager.resolve follows the resulting loose symbolic references without a default depth...

CVE-2026-63475: isomorphic-git: isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers

isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git persists server-supplied circular symref= capabilities through updateRemoteRefs, and GitRefManager.resolve follows the resulting loose symbolic references without a default depth...

PT-2026-136368

Name of the Vulnerable Software and Affected Versions isomorphic-git versions prior to 1.38.6 Description The software persists server-supplied circular symref capabilities through updateRemoteRefs. The GitRefManager.resolve function follows these loose symbolic references without a default depth...