CVE-2026-102990
HighCVSS 8.2Summary
basic-ftp before version 6.2.1 contains a ReDoS vulnerability in Client.list(). A malicious or compromised FTP server can force quadratic CPU time parsing a directory listing, blocking the Node.js event loop and freezing the process.
Risk Assessment
An attacker-controlled FTP server can cause denial of service for applications using basic-ftp, leading to service disruption and potential financial losses.
Recommendation
Upgrade basic-ftp to version 6.2.1 or later, which includes a fix for the regex backtracking issue.
Other vulnerabilities in basic-ftp
See all- CVE-2026-44240High
The vulnerability in basic-ftp prior to version 5.3.1 allows for client-side denial of service when parsing multiline FTP control responses. A malicious FTP server can send an unterminated response, leading to excessive memory and CPU usage.
- CVE-2026-39983High
The basic-ftp library for Node.js prior to version 5.2.1 is vulnerable to FTP command injection via CRLF sequences in file path parameters. An attacker can exploit this to execute arbitrary FTP commands on the server.
Original NVD description (English source)
basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list() can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RE_LINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group fields when a long Unix-style line has a valid prefix but cannot satisfy the later size and date fields. parseList() selects a parser from the last nonblank line and then applies it to every line, so a normal final line can select the Unix parser while an earlier crafted line blocks the Node.js event loop and freezes the process. This issue is fixed in version 6.2.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS