EUVD-2026-110513

OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain argon2id hashes of ingestion credentials through the client.list tRPC query. Attackers can request client.list with a project ID and receive full Client rows including the secr...

CVE-2026-116805

OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain argon2id hashes of ingestion credentials through the client.list tRPC query. Attackers can request client.list with a project ID and receive full Client rows including the secr...

CVE-2026-116805 OpenPanel before 3.0.0 Information Disclosure of Ingestion Secret Hashes via client.list

OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain argon2id hashes of ingestion credentials through the client.list tRPC query. Attackers can request client.list with a project ID and receive full Client rows including the secr...

CVE-2026-116805

OpenPanel versions prior to 3.0.0 are vulnerable to an information disclosure flaw via the client.list tRPC query. This vulnerability allows users with read-level project permissions to obtain argon2id hashes of ingestion credentials. By requesting client.list with a specific project ID, an attac...

basic-ftp FTP Client DoS

The vulnerability of the Client.list function in the FTP-client library of the basic-ftp software platform for Node.js lies in the use of a regular expression with inefficient computational complexity. Exploiting this vulnerability could allow an attacker to cause service interruptions remotely...

Regular Expression Denial of Service (ReDoS)

Overview basic-ftp is a FTP client for Node.js, supports FTPS over TLS, IPv6, Async/Await, and Typescript. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via unanchored regular expressions in Client.list specifically in parseListDOS.ts and...

NPM: basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)

NPM: basic-ftp: Quadratic-time CPU denial of service in Client.list Unix directory-listing parser RELINE backtracking vulnerability discovered by ? in WordPress Npm basic-ftp versions = 6.2.0...

basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)

Summary Client.list parses the server's directory listing with the Unix-style parser in parseListUnix.js. Its RELINE regex has two adjacent \S+?:\s\S+ groups owner name, then group name followed by a required numeric size group. When a line starts with a valid listing prefix but the tokens after ...

EUVD-2026-90360

basic-ftp: Quadratic-time CPU denial of service in Client.list Unix directory-listing parser RELINE backtracking...

GHSA-C475-QRG2-PJ4R basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)

Summary Client.list parses the server's directory listing with the Unix-style parser in parseListUnix.js. Its RELINE regex has two adjacent \S+?:\s\S+ groups owner name, then group name followed by a required numeric size group. When a line starts with a valid listing prefix but the tokens after ...

PT-2026-105502

Summary Client.list parses the server's directory listing with the Unix-style parser in parseListUnix.js. Its RE LINE regex has two adjacent S+?:sS+ groups owner name, then group name followed by a required numeric size group. When a line starts with a valid listing prefix but the tokens after it...

Linux Distros Unpatched Vulnerability : CVE-2026-102990

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a...

DEBIAN-CVE-2026-102990

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RELINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group field...

CVE-2026-102990

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RELINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group field...

UBUNTU-CVE-2026-102990

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RELINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group field...

CVE-2026-102990

The basic-ftp FTP client for Node.js (prior to version 6.2.1 ) is vulnerable to a quadratic-time CPU denial of service . A malicious or compromised FTP server can trigger this by providing a crafted directory listing where the RE_LINE expression in src/parseListUnix.ts backtracks across adjacent ...

CVE-2026-102990

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RELINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group field...

CVE-2026-102990 basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RELINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group field...

CVE-2026-102990

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RELINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group field...

CVE-2026-102990 basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RELINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group field...