CVE-2026-102990

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-102990
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102990.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-102990
Aliases
Downstream
Published
2026-09-30T19:44:47Z
Modified
2026-10-02T03:47:25Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)
Details

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list() can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RE_LINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group fields when a long Unix-style line has a valid prefix but cannot satisfy the later size and date fields. parseList() selects a parser from the last nonblank line and then applies it to every line, so a normal final line can select the Unix parser while an earlier crafted line blocks the Node.js event loop and freezes the process. This issue is fixed in version 6.2.1.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-1333"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102990.json"
}
References

Affected packages

Git / github.com/patrickjuchli/basic-ftp

Affected ranges

Type
GIT
Repo
https://github.com/patrickjuchli/basic-ftp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d0d9e07c56e519587bb50532ac6eadbb0cb0cfe9
Fixed
a5b160ff7d127130107789029aec98632c51fd60
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "6.2.1"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.0.6
4.*
4.6.6
v1.*
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.7
v1.0.8
v1.0.9
v1.1.0
v1.1.1
v1.2.0
v2.*
v2.0.0
v2.1.0
v2.10.0
v2.12.0
v2.12.1
v2.12.2
v2.12.3
v2.13.0
v2.13.1
v2.13.2
v2.14.0
v2.14.1
v2.14.2
v2.14.3
v2.14.4
v2.15.0
v2.16.0
v2.16.1
v2.17.0
v2.17.1
v2.2.0
v2.2.1
v2.3.0
v2.3.1
v2.3.2
v2.3.3
v2.4.0
v2.4.1
v2.4.2
v2.5.0
v2.5.1
v2.5.2
v2.6.0
v2.6.1
v2.6.2
v2.7.0
v2.7.1
v2.8.0
v2.8.1
v2.8.2
v2.8.3
v2.9.0
v2.9.1
v2.9.2
v3.*
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.2.2
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v3.5.0
v3.6.0
v3.7.0
v3.7.1
v3.8.0
v3.8.1
v3.8.2
v3.8.3
v4.*
v4.0.0
v4.0.1
v4.0.2
v4.1.0
v4.2.0
v4.2.1
v4.3.0
v4.3.1
v4.3.2
v4.4.0
v4.4.1
v4.5.0
v4.5.1
v4.5.2
v4.5.3
v4.5.4
v4.6.0
v4.6.1
v4.6.2
v4.6.3
v4.6.4
v4.6.5
v5.*
v5.0.0
v5.0.1
v5.0.2
v5.0.3
v5.0.4
v5.0.5
v5.1.0
v5.2.0
v5.2.1
v5.2.2
v5.3.0
v5.3.1
v6.*
v6.0.0
v6.0.1
v6.0.2
v6.1.0
v6.2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102990.json"