CVE-2026-102990 basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)
A malicious FTP server can cause a Node.js application using basic-ftp to hang via quadratic CPU time in directory listing parsing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-102990?
CVE-2026-102990 is a high-severity denial of service vulnerability in patrickjuchli basic-ftp, published on 30 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list() can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RE_LINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group fields when a long Unix-style line has a valid prefix but cannot satisfy the later size and date fields. parseList() selects a parser from the last nonblank line and then applies it to every line, so a normal final line can select the Unix parser while an earlier crafted line blocks the Node.js event loop and freezes the process. This issue is fixed in version 6.2.1.
Weakness: CWE-1333
Which versions are affected by CVE-2026-102990?
2 open source packages ship an affected version, including basic-ftp.
| Package | Affected | Fixed in |
|---|---|---|
basic-ftp npm | All versions | 6.2.1 |
basic-ftp npm | All versions | 6.2.1 |
How do I fix CVE-2026-102990?
Upgrade basic-ftp to 6.2.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-102990 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-102990 exists.
Sources
Also known as CLSA-2026-1792170033, CLSA-2026-1792170040, DEBIAN-CVE-2026-102990, ECHO-aca6-d26b-eefc, GHSA-c475-qrg2-pj4r, MINI-2h68-vvpj-gxfv and 19 more.