An attacker controlling an FTP server can serve a crafted directory listing line to an basic-ftp client. When the client executes Client.list(), the regex engine attempts to resolve the ambiguous token structure, resulting in quadratic-time (O(n²)) CPU complexity relative to the length of the malicious string. Because Node.js is single-threaded, this operation blocks the event loop entirely, rendering the client unresponsive for extended periods. Given the default maxListingBytes of 40 MB, a single malicious line can effectively hang the client process for minutes.

Impact

The vulnerability results in a total client-side denial of service by freezing the Node.js event loop. This affects any application utilizing basic-ftp to connect to untrusted or compromised FTP servers. Depending on the scale of the malicious input provided, the process can remain unresponsive for extended periods, potentially disrupting mission-critical services or automated processes that rely on the FTP client.

Recommendation

Prioritized actions for teams using the basic-ftp library:

• Update the basic-ftp package to a version patched against CVE-2026-102990.
• Audit all code paths using Client.list() to ensure that connections are restricted to trusted FTP servers only.
• Implement request timeouts at the application level to force-close connections that exceed expected latency thresholds, serving as a secondary mitigation against hanging event loops.