CVE-2026-102990 in basic-ftp
Summary
by MITRE • 09/30/2026
basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list() can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RE_LINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group fields when a long Unix-style line has a valid prefix but cannot satisfy the later size and date fields. parseList() selects a parser from the last nonblank line and then applies it to every line, so a normal final line can select the Unix parser while an earlier crafted line blocks the Node.js event loop and freezes the process. This issue is fixed in version 6.2.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified in basic-ftp versions prior to 6.2.1 represents a significant availability risk rooted in algorithmic complexity exploitation, specifically categorized under CWE-400: Uncontrolled Resource Consumption. As an FTP client library for Node.js, basic-ftp relies on regular expressions to parse directory listings returned by remote servers. The core technical flaw resides within the RE_LINE expression defined in src/parseListUnix.ts, which is designed to match Unix-style file listing formats. This regular expression contains adjacent variable-length fields representing owner and group names. When processing a maliciously crafted FTP response where a line has a valid prefix but fails to satisfy subsequent constraints for size and date fields, the regex engine engages in catastrophic backtracking. Instead of failing quickly upon mismatch, the engine exhaustively explores numerous combinations of character splits across the variable-length fields before determining that no match exists. This behavior results in quadratic CPU time complexity relative to the length of the input string, effectively turning a simple parsing operation into a computationally expensive task.
The operational impact is exacerbated by the architectural design of the parseList function within basic-ftp. The library determines which parser to use based on the last non-blank line of the directory listing. A malicious FTP server can exploit this logic by sending a long, crafted Unix-style line early in the response that triggers the regex backtracking issue, followed by a normal final line that selects the Unix parser for all subsequent lines. Because Node.js operates on a single-threaded event loop model, the excessive CPU consumption caused by the regex engine blocks the main thread entirely. This results in a complete freeze of the application process, preventing it from handling other requests or performing any asynchronous operations. For services relying on basic-ftp to manage file transfers, this constitutes a severe Denial of Service condition where legitimate users are unable to access resources due to the unresponsiveness of the server-side Node.js instance.
From a threat modeling perspective, this vulnerability aligns with ATT&CK technique T1496: Resource Hijacking, specifically through computational exhaustion. An attacker does not need to compromise credentials or exploit authentication flaws; they merely need to interact with an exposed FTP service that utilizes basic-ftp as its client component. The attack vector is remote and requires no special privileges beyond the ability to connect to the target FTP server if it is compromised or controlled by a malicious actor, or potentially through a man-in-the-middle scenario where the attacker can inject malformed directory listings into the stream. The simplicity of the exploit makes it highly feasible for automated scanning tools to identify and leverage this weakness against vulnerable systems.
Mitigation strategies primarily involve upgrading basic-ftp to version 6.2.1 or later, which addresses the regex backtracking issue by optimizing the parsing logic to prevent excessive computational overhead on malformed input. In environments where immediate patching is not feasible, defensive measures should include implementing strict rate limiting and connection timeouts at the network perimeter to limit the duration of any single FTP session. Additionally, deploying a Web Application Firewall or intrusion detection system capable of inspecting FTP traffic for anomalously long directory listings can help mitigate the risk by blocking requests that exceed expected size thresholds before they reach the vulnerable application layer. Regular security assessments focusing on input validation and resource consumption patterns are recommended to identify similar algorithmic complexity vulnerabilities in other components of the software supply chain.