Read the docs
TI-2026-84490 Aliases CVE-2026-63475

Circular symbolic refs hang ref resolution in isomorphic-git

Priority MEDIUM 53CWE-674Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-674.

Summary

isomorphic-git before 1.38.6 follows circular symbolic references that a remote supplies during clone, without a depth limit or cycle detection. An attacker operating a malicious or man-in-the-middle remote can trigger this (CWE-674). Operations such as log, status, checkout and branch then never terminate. The circular references stay on disk, leaving the repository unusable and causing a persistent denial of service.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git persists server-supplied circular symref= capabilities through updateRemoteRefs, and GitRefManager.resolve() follows the resulting loose symbolic references without a default depth limit or cycle detection. After a clone from a malicious or man-in-the-middle-controlled remote, operations such as log, status, checkout, and branch that resolve refs/remotes/origin/a or refs/remotes/origin/b do not terminate. The circular references remain on disk, leaving the repository unusable for the application and causing a persistent denial of service. This issue is fixed in version 1.38.6.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00398 34th percentileScored 2026-11-07
Fix Partial isomorphic-git (isomorphic-git): 1.38.6Red Hat: 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
isomorphic-gitisomorphic-gitbefore 1.38.61.38.6Patch availableCNA
  • isomorphic-git Vendorisomorphic-git Affected before 1.38.6 Fixed in 1.38.6 Patch available CNA

Remediation

Upgrade isomorphic-git to version 1.38.6. Red Hat lists OpenShift Serverless, Red Hat Developer Hub 1 and Self-service automation portal 2 as affected, with no fix available.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA isomorphic-git (isomorphic-git) Fixed in 1.38.6

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift ServerlessAffectedNo fix yet: Fix deferred
Red Hat Developer Hub 1AffectedNo fix yet: Fix deferred
Self-service automation portal 2AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-63475
  2. 2026-11-03 CISA SSVC decision points changed
  3. 2026-11-03 Priority changed: LOW → MEDIUM
  4. 2026-11-04 Affected versions changed · Red Hat
  5. 2026-11-04 CVSS score added · Red Hat

References

Other 4

  • TI-2026-84487 Path traversal in isomorphic-git checkout lets attackers write files CVSS 3.1HIGH 8.8
  • TI-2026-84492 isomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working directory on clone/checkout CVSS 3.1MEDIUM 5.3
  • TI-2026-84491 Unbounded memory allocation in isomorphic-git delta handling CVSS 3.1MEDIUM 4.3
  • TI-2021-06178 Server-side request forgery (SSRF) in @isomorphic-git/cors-proxy CVSS 3.1HIGH 8.6
  • TI-2026-60327 isomorphic-git < 1.42.0 Prototype Pollution via getRemoteInfo CVSS 4.0HIGH 7.1
  • TI-2021-10885 isomorphic-git before 1.8.2 allows Directory Traversal via a crafted repository. CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences