patrickjuchli basic-ftp up to 6.2.0 Unix Parser src/parseListUnix.ts Client.list denial of service

Summaryinfo

A vulnerability was found in patrickjuchli basic-ftp up to 6.2.0. It has been rated as problematic. The affected element is the function Client.list of the file src/parseListUnix.ts of the component Unix Parser. This manipulation causes denial of service. This vulnerability appears as CVE-2026-102990. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic was found in patrickjuchli basic-ftp up to 6.2.0. Affected by this vulnerability is the function Client.list of the file src/parseListUnix.ts of the component Unix Parser. The manipulation with an unknown input leads to a denial of service vulnerability. The CWE definition for the vulnerability is CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. As an impact it is known to affect availability. The summary by CVE is:

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list() can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RE_LINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group fields when a long Unix-style line has a valid prefix but cannot satisfy the later size and date fields. parseList() selects a parser from the last nonblank line and then applies it to every line, so a normal final line can select the Unix parser while an earlier crafted line blocks the Node.js event loop and freezes the process. This issue is fixed in version 6.2.1.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-102990 since 09/29/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

Upgrading to version 6.2.1 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• patrickjuchli

Name

• basic-ftp

Version

• 6.0
• 6.1
• 6.2.0

Website

• Product: https://github.com/patrickjuchli/basic-ftp/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion