CVE-2026-102990: basic-ftp quadratic-time denial of service in Client.list()

CVE-2026-102990 · Severity: high · CVSS 4 · Published 2026-09-30

basic-ftp is an FTP client library for Node.js applications. A malicious or compromised FTP server can craft specially formatted directory listings that force the client's list() function to consume quadratic CPU time, freezing the application and causing a denial of service. This occurs because the client's Unix directory line parser uses regex with excessive backtracking on crafted input.

Technologies: basic-ftp (npm), Patrick Juchli Basic-Ftp. Vendors: npm, Patrick Juchli.

Quick answers

Is CVE-2026-102990 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-102990 being exploited in the wild.
How severe is CVE-2026-102990?
High severity, with a CVSS score of 4, published 30 September 2026.
Which products and versions are affected?
basic-ftp (npm) <= 6.2.0, SEMVER:introduced=0,fixed=6.2.1; Patrick Juchli Basic-Ftp before 6.2.1.
Is there a fix for CVE-2026-102990?
Yes. basic-ftp (npm): upgrade to 6.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102990 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-102990?
Check whether you run basic-ftp (npm) or Patrick Juchli Basic-Ftp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • basic-ftp (npm): upgrade to 6.2.1 or later
    npm install basic-ftp@6.2.1

Technical details

The vulnerability exists in the RE_LINE regex in src/parseListUnix.ts, which exhibits catastrophic backtracking when parsing Unix-style FTP directory listings with variable-length owner and group fields. An attacker controlling or compromising the FTP server can provide a directory listing with a normal final line (to select the Unix parser) followed by crafted earlier lines that trigger exponential regex backtracking, blocking the Node.js event loop. The fix in version 6.2.1 optimizes the regex to prevent backtracking.

Affected products

  • Patrick Juchli basic-ftp before 6.2.1

Identifiers

  • CVE-2026-102990
  • GHSA-c475-qrg2-pj4r

Timeline

  • 2026-09-30: disclosed
  • 2026-08-26: patched: Version 6.2.1 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.