CVE-2026-102990
Deferred Deferred - Pending Action

FTP Client Quadratic CPU DoS via Malicious Directory Listing

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: GitHub, Inc.

Description
basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list() can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RE_LINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group fields when a long Unix-style line has a valid prefix but cannot satisfy the later size and date fields. parseList() selects a parser from the last nonblank line and then applies it to every line, so a normal final line can select the Unix parser while an earlier crafted line blocks the Node.js event loop and freezes the process. This issue is fixed in version 6.2.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-10-19
AI Q&A
2026-09-30
EPSS Evaluated
2026-10-18
NVD
CVE-2026-102990
EUVD
EUVD-2026-90360

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
basic-ftp basic-ftp to 6.2.1 (exc)
patrickjuchli basic-ftp to 6.2.1 (exc)
patrickjuchli basic-ftp 6.2.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1333 The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the basic-ftp library for Node.js. It allows a malicious FTP server to cause excessive CPU usage by sending a specially crafted directory listing. The issue occurs in the Client.list() function, which uses a regular expression that backtracks across fields in Unix-style directory listings, leading to quadratic time complexity and freezing the Node.js event loop.

Detection Guidance

This vulnerability is specific to the basic-ftp library in Node.js applications. To detect it, check if your application uses basic-ftp versions prior to 6.2.1. Run 'npm list basic-ftp' in your project directory to see the installed version.

Impact Analysis

If you use a vulnerable version of basic-ftp (before 6.2.1), a malicious FTP server could freeze your application by sending a maliciously crafted directory listing. This would block the Node.js event loop, making your application unresponsive until the server disconnects or the process is terminated.

Compliance Impact

This vulnerability primarily causes CPU exhaustion via denial-of-service, which may indirectly impact compliance by disrupting system availability or performance. GDPR requires data processing integrity and availability (Article 32), while HIPAA mandates safeguards for data accessibility (Security Rule §164.312). Prolonged service disruption could violate these requirements if systems fail to process or protect data as intended.

Mitigation Strategies

Upgrade the basic-ftp library to version 6.2.1 or later using 'npm install basic-ftp@latest'. If upgrading is not possible, consider replacing basic-ftp with an alternative FTP client library that is actively maintained and secure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102990. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart