Disclosure summary
basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list() can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RE_LINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group fields when a long Unix-style line has a valid prefix but cannot satisfy the later size and date fields. parseList() selects a parser from the last nonblank line and then applies it to every line, so a normal final line can select the Unix parser while an earlier crafted line blocks the Node.js event loop and freezes the process. This issue is fixed in version 6.2.1.
Source-reported weakness categories
CWE-1333
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
GitHub Reviewed Security Advisories · GHSA-c475-qrg2-pj4r
Open original source · Updated Oct 01, 2026
basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)
Source severity: HIGH / 8.2
| Ecosystem | Package | Affected range | First patched |
|---|---|---|---|
| npm | basic-ftp | 6.2.1 |
NIST National Vulnerability Database · NVD-CVE-2026-102990
Open original source · Updated Sep 30, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
Original records & references
PUBLISHED 2026-09-30T16:17:26-04:00
MODIFIED 2026-09-30T17:17:06-04:00
INGESTED 2026-10-06T11:44:59-04:00