Denial of Service Vulnerability in Isomorphic-Git by Isomorphic Git

CVE-2026-63475

What is CVE-2026-63475?

The Isomorphic-Git library, a pure JavaScript implementation of Git for Node.js and browsers, has a vulnerability that allows for denial of service. In versions prior to 1.38.6, the library mishandles circular symbolic references from remote servers, which leads to persistent undefined states during repository operations. This can cause log, status, checkout, and branch commands to hang indefinitely when resolving specific remote references. Consequently, affected repositories can become unusable, especially if compromised by a malicious remote or man-in-the-middle attack. The issue has been addressed in version 1.38.6, which introduces safeguards against circular references.

References