Infinite loop Affecting isomorphic-git package, versions <1.38.6
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-ISOMORPHICGIT-22193069
- published4 Nov 2026
- disclosed3 Nov 2026
- creditMo Sakr
Introduced: 3 Nov 2026
NewCVE-2026-63475 (opens in a new tab)How to fix?
Upgrade isomorphic-git to version 1.38.6 or higher.
Overview
isomorphic-git is a pure JavaScript reimplementation of git that works in both Node.js and browser JavaScript environments. It can read and write to git repositories, fetch from and push to git remotes (such as GitHub), all without any native C++ module dependencies.
Affected versions of this package are vulnerable to Infinite loop via GitRefManager.resolve(), which follows symbolic references with no cycle detection and no default depth limit. A malicious or MitM server can advertise circular symref= capabilities (e.g. a → b and b → a) during a clone; updateRemoteRefs persists these unconditionally to disk as loose symrefs. Any subsequent operation that resolves one of those references (log, status, checkout, branch, etc.) enters an infinite loop, freezing the application and leaving the repository permanently unusable.
PoC
https://github.com/spiceoverflow/av5-circular-symref — open in a Codespace; clone writes the circular symrefs, then git.log on one never returns (the runner stops it after a 20s hang):
[AV-5] refs/remotes/origin/a contains: ref: refs/remotes/origin/b
[AV-5] refs/remotes/origin/b contains: ref: refs/remotes/origin/a
[run] *** DoS CONFIRMED: resolving a circular symref never terminates ***