Quadratic CPU Time Vulnerability in basic-ftp FTP Client for Node.js

CVE-2026-102990

What is CVE-2026-102990?

The basic-ftp FTP client for Node.js has a vulnerability that allows a malicious FTP server to induce excessive CPU usage through the Client.list() function. An attacker can craft a directory listing that, due to the design flaw in the RE_LINE regex used for parsing, causes the application to consume quadratic CPU time. This occurs when valid prefix lines do not align with expected size and date fields, blocking the Node.js event loop and potentially freezing the entire process. The issue is addressed in version 6.2.1, underscoring the importance of keeping the client updated.

References