{"vulnerability": "cve-2026-102990", "sightings": [{"uuid": "18beb2d9-9e8a-40d5-9a69-e6a86a6699ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-102990", "type": "seen", "source": "https://gist.github.com/alon710/d01c7893841d173a89619ac514aef74e", "content": "# CVE-2026-102990: CVE-2026-102990: Regular Expression Denial of Service in basic-ftp Directory Parsing\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-10-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-102990\n\n## Summary\nA highly critical Regular Expression Denial of Service (ReDoS) vulnerability in basic-ftp, an FTP client library for Node.js. In versions prior to 6.2.1, a malicious or compromised FTP server can exploit this vulnerability to force the FTP client to consume quadratic CPU time during directory parsing. This issue blocks the single-threaded Node.js event loop, freezing the application process and leading to a complete Denial of Service (DoS).\n\n## TL;DR\nUnanchored regular expressions and adjacent variable-length capture groups in basic-ftp's Unix and DOS directory-listing parsers allow a malicious FTP server to cause CPU exhaustion and freeze Node.js client applications.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1333\n- **Attack Vector**: Network\n- **CVSS v4.0**: 8.2 (High)\n- **EPSS Score**: 0.00507\n- **Impact**: Availability (High)\n- **Exploit Status**: PoC Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- basic-ftp NPM package versions prior to 6.2.1\n- Node.js applications consuming basic-ftp for directory listing processing\n- **basic-ftp**: < 6.2.1 (Fixed in: `6.2.1`)\n\n## Mitigation\n\n- Upgrade basic-ftp to version 6.2.1 or newer.\n- Avoid connecting to untrusted or user-supplied FTP server addresses.\n- Use network egress filtering to restrict FTP connections to trusted hosts.\n- Run directory listing operations inside isolated worker threads or child processes.\n\n**Remediation Steps:**\n1. Run 'npm install basic-ftp@6.2.1' to update the dependency to a secure version.\n2. Audit the dependency tree using 'npm list basic-ftp' to identify vulnerable transitive dependencies.\n3. Verify the update using the official regression test suite to ensure DoS resistance is active.\n\n## References\n\n- [GitHub Security Advisory](https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-c475-qrg2-pj4r)\n- [NVD - CVE-2026-102990](https://nvd.nist.gov/vuln/detail/CVE-2026-102990)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-102990) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-01T15:30:31.000000Z"}, {"uuid": "4a526b11-00fb-4e1b-b637-9d8497e9e2d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-102990", "type": "published-proof-of-concept", "source": "https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-c475-qrg2-pj4r", "content": "", "creation_timestamp": "2026-08-27T19:41:36.000000Z"}]}