CVE-2026-102990 Details

A denial-of-service vulnerability has been identified in the basic-ftp FTP client for Node.js, specifically in versions prior to 6.2.1. The issue arises in the Unix-style directory listing parser of the Client.list() function. A malicious or compromised FTP server can craft a directory listing that forces the client to spend excessive CPU time parsing it. This is due to the regular expression used in the parser, which can backtrack across variable-length owner and group fields. As a result, a single long line can be manipulated to create a quadratic-time processing delay, effectively freezing the Node.js event loop and the entire process.

Users can upgrade to basic-ftp version 6.2.1, which addresses the vulnerability by modifying the regex used in the Unix parser to prevent backtracking that could be exploited to cause a denial-of-service.