basic-ftp CVE-2026-102990

Exploitation requires that the victim application (1) uses basic-ftp prior to 6.2.1, (2) connects - via Client - to an FTP server the attacker controls or has compromised, and (3) invokes Client.list() to parse a directory listing. The attacker-controlled listing must include a long Unix-style line whose prefix matches RE_LINE but whose later size and date fields fail, forcing quadratic backtracking across the variable-length owner/group fields, while a benign final nonblank line ensures parseList() selects the Unix parser and applies it to the crafted line. The core limiting factor is the trust direction: the client must reach out to an untrusted/hostile FTP server, so deployments that only connect to trusted, controlled FTP endpoints are not realistically exposed. No authentication of the attacker is needed (PR:N) and no user interaction beyond the normal list operation (UI:N), but the AT:P precondition (contacting a malicious server) constrains real-world reach.

This is a genuine but bounded availability risk. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H) correctly scopes the impact to availability only - a CWE-1333 inefficient-regex (ReDoS) condition where RE_LINE in parseListUnix.ts backtracks quadratically, blocking the Node.js single-threaded event loop and freezing the entire process. The AT:P (Attack Requirement: Present) is the pivotal signal: exploitation is not opportunistic against a listening service but requires the victim's basic-ftp client to connect to a malicious or compromised FTP server and call Client.list(). This inverts the usual client/server trust direction, so the practical attacker is a rogue/compromised FTP endpoint the client chooses to contact. No EPSS score, no CISA KEV listing, and no public POC were provided - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The 8.2 severity is driven by network reach and low complexity, but the AT:P precondition and DoS-only impact (no confidentiality/integrity, no RCE) mean real-world priority is moderate, weighted by how many deployments point basic-ftp at untrusted servers. The commit's own comment confirms the O(n²) mechanism and the fix (anchoring the regex and bounding owner/group word counts to {0,7}), so the technical claim is well-substantiated.

An attacker who controls or has compromised an FTP server waits for a Node.js application using basic-ftp (<6.2.1) to connect and call Client.list(). The server returns a directory listing containing a crafted long Unix-style line with a valid prefix that cannot satisfy the later size/date fields, plus a normal final line so parseList() still selects the Unix parser; parsing the malicious line triggers catastrophic regex backtracking that pegs the CPU and freezes the event loop. No public POC is referenced, but the fix commit describes the O(n²) mechanism precisely, making reproduction straightforward.