DailyCVE@dailycve
🔴 basic-ftp, ReDoS (Catastrophic Backtracking), #CVE-2026-102990 (High) -DC-Oct2026-2693 https://dailycve.com/basic-ftp-redos-catastrophic-backtracking-cve-2026-102990-high-dc-oct2026-2693/
0000029
238 followersView on X
CVE-2026-102990
LOWCVSS 8.2 · HIGHSignal is active with 2 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list() can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RE_LINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group fields when a long Unix-style line has a valid prefix but cannot satisfy the later size and date fields. parseList() selects a parser from the last nonblank line and then applies it to every line, so a normal final line can select the Unix parser while an earlier crafted line blocks the Node.js event loop and freezes the process. This issue is fixed in version 6.2.1.
0.0/ 10 priority
Sources & remediation
Other references
- https://github.com/patrickjuchli/basic-ftp/commit/d0d9e07c56e519587bb50532ac6eadbb0cb0cfe9
- https://github.com/patrickjuchli/basic-ftp/releases/tag/v6.2.1
- https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-c475-qrg2-pj4r
- https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-c475-qrg2-pj4r
Weakness type (CWE)
CWE-1333
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 2 mentions across 1 observed day
What's happening
- 2 total mentions across 1 day
Deep dive
Activity timeline2 mentions / 1d
Referenced assets1 URL
Full discourse2 posts
Upwind Security MDR@UpwindMDR🚨HIGH - basic-ftp DoS via quadratic Unix LIST regex backtracking (CVE-2026-102990) basic-ftp’s Client.list() parses Unix-style directory listings using a regex with inefficient backtracking; a malicious/compromised FTP server can return a crafted LIST response that drives quadratic CPU, blocking the Node.js event loop and freezing the process. MLSD-based listings aren’t affected. 👉Affected: basic-ftp < 6.2.1 | Upgrade to 6.2.1
0000050308 followersView on X