The vulnerability in basic-ftp (CVE-2026-102990) arises from the RE_LINE regular expression used in src/parseListUnix.ts for parsing Unix-style FTP directory listings. When a directory listing line has a valid prefix but fails to satisfy later size and date fields, the regex backtracks excessively across adjacent variable-length owner and group fields, causing quadratic CPU time complexity. The parseList() function applies the Unix parser selected from the last nonblank line to all lines, allowing a crafted earlier line to block the Node.js event loop and freeze the process. This denial-of-service condition is fixed in basic-ftp version 6.2.1.

An attacker controlling or compromising an FTP server can send specially crafted directory listings that cause the basic-ftp client to consume excessive CPU resources, blocking the Node.js event loop and freezing the client process. This results in a denial-of-service condition for applications using vulnerable versions of basic-ftp.

Upgrade basic-ftp to version 6.2.1 or later, where the inefficient regular expression has been fixed. No other mitigations are indicated by the vendor advisory.