CVE-2026-102990

Name of the Vulnerable Software and Affected Versions basic-ftp versions prior to 6.2.1

Description The Client.list() function is susceptible to a Denial of Service (DoS) when interacting with a malicious or compromised FTP server. The issue occurs during the parsing of Unix-style directory listings where the RE LINE expression in src/parseListUnix.ts performs inefficient backtracking across adjacent variable-length owner and group fields. This happens when a long Unix-style line contains a valid prefix but fails to satisfy subsequent size and date fields. Because parseList() applies the selected parser to every line, a crafted response can cause quadratic CPU consumption, blocking the Node.js event loop and freezing the process. Listings based on MLSD are not affected.

Recommendations Update basic-ftp to version 6.2.1.