CVE-2026-102990: basic-ftp Quadratic-Time CPU Denial of Service in Client.list() Unix Directory-Listing Parser
Summary
CVE-2026-102990: Client.list() parses the server's directory listing with the Unix-style parser in parseListUnix.js. Affects basic-ftp versions < 6.2.1. Fixed in 6.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
basic-ftp is an FTP client for Node.js that allows users to interact with FTP servers for file transfers. It provides a simple API for connecting to FTP servers, listing directories, and uploading or downloading files. The package is widely used due to its ease of use and efficiency in handling FTP operations. However, it is vulnerable to a denial of service attack due to a flaw in its Unix-style directory-listing parser, which can lead to significant performance degradation when processing maliciously crafted directory listings.
Vulnerability Detail
The vulnerability arises from the Client.list() method, which utilizes a Unix-style parser in parseListUnix.js. The regex used for parsing directory listings contains two adjacent groups that can cause excessive backtracking when processing certain inputs. If a line in the directory listing starts with a valid prefix but fails to satisfy the expected tokens, the regex engine may backtrack excessively, resulting in a quadratic time complexity (O(n²)) for matching. This can lead to the Node.js event loop being blocked for extended periods, effectively causing a denial of service. The impact is severe, as a single maliciously crafted line can freeze the entire process, making it unresponsive.
How To Fix
Latest published version: 6.2.3 as of 23 Oct 2026
npm install basic-ftp@6.2.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.2.1
This is the first release that contains the fix.
npm install basic-ftp@6.2.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the maximum size of directory listings processed by the client by setting the maxListingBytes option to a lower value. This can help mitigate the impact of the vulnerability by preventing excessively large listings from being processed. Example code to set this option is as follows:
const ftp = require('basic-ftp');
const client = new ftp.Client();
client.ftp.maxListingBytes = 1024 * 1024; // Set max listing size to 1 MB
Conclusion
The basic-ftp package has a significant vulnerability (CVE-2026-102990) that can lead to denial of service through its directory-listing parser. It is crucial to update to version 6.2.1 or later to mitigate this risk. Additionally, using Vulert can help you monitor for such vulnerabilities in your applications effectively.
See every vulnerability recorded for basic-ftp →
FAQ
CVE-2026-102990 is a vulnerability in the basic-ftp package that allows for a denial of service due to a quadratic-time CPU usage issue in the Client.list() method.
If your application uses the basic-ftp package, a malicious FTP server could exploit this vulnerability to freeze your application by sending specially crafted directory listings.
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By checking your package-lock.json file, Vulert can help you identify if your application is affected by this vulnerability.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for basic-ftp.
