GHSA-C475-QRG2-PJ4R basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)

Summary Client.list parses the server's directory listing with the Unix-style parser in parseListUnix.js. Its RELINE regex has two adjacent \S+?:\s\S+ groups owner name, then group name followed by a required numeric size group. When a line starts with a valid listing prefix but the tokens after ...

basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)

Summary Client.list parses the server's directory listing with the Unix-style parser in parseListUnix.js. Its RELINE regex has two adjacent \S+?:\s\S+ groups owner name, then group name followed by a required numeric size group. When a line starts with a valid listing prefix but the tokens after ...

CVE-2026-102990

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RELINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group field...

UBUNTU-CVE-2026-102990

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RELINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group field...

CVE-2026-102990 basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RELINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group field...

CVE-2026-102990

The basic-ftp FTP client for Node.js (prior to version 6.2.1 ) is vulnerable to a quadratic-time CPU denial of service . A malicious or compromised FTP server can trigger this by providing a crafted directory listing where the RE_LINE expression in src/parseListUnix.ts backtracks across adjacent ...

CVE-2026-102990 basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RELINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group field...

CVE-2026-102990 basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RELINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group field...

CVE-2026-102990

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RELINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group field...

CVE-2026-102990: Inefficient Regular Expression Complexity

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RELINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group field...