CVE-2026-102990
— UNSCOREDpublic exploit availablePublished 2026-09-30 · Updated 2026-09-30
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list() can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RE_LINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group fields when a long Unix-style line has a valid prefix but cannot satisfy the later size and date fields. parseList() selects a parser from the last nonblank line and then applies it to every line, so a normal final line can select the Unix parser while an earlier crafted line blocks the Node.js event loop and freezes the process. This issue is fixed in version 6.2.1.
Weaknesses
CWE-1333
Public exploit & PoC references
- https://github.com/patrickjuchli/basic-ftp/commit/d0d9e07c56e519587bb50532ac6eadbb0cb0cfe9
- https://github.com/patrickjuchli/basic-ftp/releases/tag/v6.2.1
- https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-c475-qrg2-pj4r
- https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-c475-qrg2-pj4r
All references
- https://github.com/patrickjuchli/basic-ftp/commit/d0d9e07c56e519587bb50532ac6eadbb0cb0cfe9
- https://github.com/patrickjuchli/basic-ftp/releases/tag/v6.2.1
- https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-c475-qrg2-pj4r
- https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-c475-qrg2-pj4r
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2026-100267
- UNSCOREDCVE-2026-101903PoC
- UNSCOREDCVE-2026-101906PoC
- MEDIUMCVE-2026-102270PoC
- MEDIUMCVE-2026-102408
- MEDIUMCVE-2026-102473
- HIGHCVE-2026-103043PoC
- UNSCOREDCVE-2026-104150PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.