UBUNTU-CVE-2026-102990

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-102990
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102990.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-102990
Upstream
Published
2026-10-02T00:00:00Z
Modified
2026-10-02T22:30:13Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list() can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RE_LINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group fields when a long Unix-style line has a valid prefix but cannot satisfy the later size and date fields. parseList() selects a parser from the last nonblank line and then applies it to every line, so a normal final line can select the Unix parser while an earlier crafted line blocks the Node.js event loop and freezes the process. This issue is fixed in version 6.2.1.

References

Affected packages

Ubuntu:24.04:LTS / node-proxy-agents

Package

Name
node-proxy-agents
Purl
pkg:deb/ubuntu/node-proxy-agents?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

Other
0~2023071921-5

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "node-agent-base",
            "binary_version":  "7.1.0~0~2023071921-5"
        },
        {
            "binary_name":  "node-args",
            "binary_version":  "5.0.3~0~2023071921-5"
        },
        {
            "binary_name":  "node-basic-ftp",
            "binary_version":  "5.0.3~0~2023071921-5"
        },
        {
            "binary_name":  "node-data-uri-to-buffer",
            "binary_version":  "5.0.1~0~2023071921-5"
        },
        {
            "binary_name":  "node-degenerator",
            "binary_version":  "5.0.1~0~2023071921-5"
        },
        {
            "binary_name":  "node-get-uri",
            "binary_version":  "6.0.1~0~2023071921-5"
        },
        {
            "binary_name":  "node-http-proxy-agent",
            "binary_version":  "7.0.0~0~2023071921-5"
        },
        {
            "binary_name":  "node-https-proxy-agent",
            "binary_version":  "7.0.1~0~2023071921-5"
        },
        {
            "binary_name":  "node-pac-proxy-agent",
            "binary_version":  "7.0.0~0~2023071921-5"
        },
        {
            "binary_name":  "node-pac-resolver",
            "binary_version":  "7.0.0~0~2023071921-5"
        },
        {
            "binary_name":  "node-proxy",
            "binary_version":  "2.1.1~0~2023071921-5"
        },
        {
            "binary_name":  "node-proxy-agent",
            "binary_version":  "6.3.0~0~2023071921-5"
        },
        {
            "binary_name":  "node-socks-proxy-agent",
            "binary_version":  "8.0.1~0~2023071921-5"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102990.json"

Ubuntu:26.04:LTS / node-proxy-agents

Package

Name
node-proxy-agents
Purl
pkg:deb/ubuntu/node-proxy-agents?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

Other
0~2025070717-2
0~2025070717-6
0~2025070717+~cs15.*
0~2025070717+~cs15.2.7-1build1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "node-agent-base",
            "binary_version":  "7.1.4~0~2025070717+~cs15.2.7-1build1"
        },
        {
            "binary_name":  "node-args",
            "binary_version":  "5.0.3~0~2025070717+~cs15.2.7-1build1"
        },
        {
            "binary_name":  "node-basic-ftp",
            "binary_version":  "5.2.0~0~2025070717+~cs15.2.7-1build1"
        },
        {
            "binary_name":  "node-data-uri-to-buffer",
            "binary_version":  "6.0.2~0~2025070717+~cs15.2.7-1build1"
        },
        {
            "binary_name":  "node-degenerator",
            "binary_version":  "5.0.1~0~2025070717+~cs15.2.7-1build1"
        },
        {
            "binary_name":  "node-get-uri",
            "binary_version":  "6.0.5~0~2025070717+~cs15.2.7-1build1"
        },
        {
            "binary_name":  "node-http-proxy-agent",
            "binary_version":  "7.0.2~0~2025070717+~cs15.2.7-1build1"
        },
        {
            "binary_name":  "node-https-proxy-agent",
            "binary_version":  "7.0.6~0~2025070717+~cs15.2.7-1build1"
        },
        {
            "binary_name":  "node-pac-proxy-agent",
            "binary_version":  "7.2.0~0~2025070717+~cs15.2.7-1build1"
        },
        {
            "binary_name":  "node-pac-resolver",
            "binary_version":  "7.0.1~0~2025070717+~cs15.2.7-1build1"
        },
        {
            "binary_name":  "node-proxy",
            "binary_version":  "2.2.0~0~2025070717+~cs15.2.7-1build1"
        },
        {
            "binary_name":  "node-proxy-agent",
            "binary_version":  "6.5.0~0~2025070717+~cs15.2.7-1build1"
        },
        {
            "binary_name":  "node-socks-proxy-agent",
            "binary_version":  "8.0.5~0~2025070717+~cs15.2.7-1build1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102990.json"