CVE catalog

CVE-2026-102990

DEBIAN-CVE-2026-102990

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.37% · Oct 25, 2026

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list() can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RE_LINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group fields when a long Unix-style line has a valid prefix but cannot satisfy the later size and date fields. parseList() selects a parser from the last nonblank line and then applies it to every line, so a normal final line can select the Unix parser while an earlier crafted line blocks the Node.js event loop and freezes the process. This issue is fixed in version 6.2.1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannode-proxy-agents130~2024040606-6vulnerable
Debiannode-proxy-agents130~2024040606-6+deb13u1vulnerable
Debiannode-proxy-agents130~2025070717+~cs15.2.7-1vulnerable
Debiannode-proxy-agents130~2025070717+~cs15.3.7-1vulnerable
Debiannode-proxy-agents130~2025070717+~cs15.3.8-1vulnerable
Debiannode-proxy-agents130~2025070717+~cs15.3.8-2vulnerable
Debiannode-proxy-agents130~2025070717+~cs15.3.8-3vulnerable
Debiannode-proxy-agents130~2025070717+~cs16.2.9-1vulnerable
Debiannode-proxy-agents130~2025070717-1vulnerable
Debiannode-proxy-agents130~2025070717-2vulnerable
Debiannode-proxy-agents130~2025070717-3vulnerable
Debiannode-proxy-agents130~2025070717-4vulnerable
Debiannode-proxy-agents130~2025070717-5vulnerable
Debiannode-proxy-agents130~2025070717-6vulnerable
Debiannode-proxy-agents140~2024040606-6vulnerable
Debiannode-proxy-agents140~2025070717+~cs15.2.7-1vulnerable
Debiannode-proxy-agents140~2025070717+~cs15.3.7-1vulnerable
Debiannode-proxy-agents140~2025070717+~cs15.3.8-1vulnerable
Debiannode-proxy-agents140~2025070717+~cs15.3.8-2vulnerable
Debiannode-proxy-agents140~2025070717+~cs15.3.8-3vulnerable
Debiannode-proxy-agents140~2025070717-1vulnerable
Debiannode-proxy-agents140~2025070717-2vulnerable
Debiannode-proxy-agents140~2025070717-3vulnerable
Debiannode-proxy-agents140~2025070717-4vulnerable
Debiannode-proxy-agents140~2025070717-5vulnerable
Debiannode-proxy-agents140~2025070717-6vulnerable
Debiannode-proxy-agents140~2025070717+~cs16.2.9-1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannode-proxy-agentsdeb140~2025070717+~cs16.2.9-1Not reportedDEBIAN-CVE-2026-102990Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [node-agent-base]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 7.1.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

    • 7.1.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

  • [node-args]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 5.0.3~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

    • 5.0.3~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

  • [node-basic-ftp]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 5.0.5~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

    • 5.0.5~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

  • [node-data-uri-to-buffer]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 6.0.2~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

    • 6.0.2~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

  • [node-degenerator]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 5.0.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

    • 5.0.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

  • [node-get-uri]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 6.0.3~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

    • 6.0.3~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

  • [node-http-proxy-agent]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 7.0.2~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

    • 7.0.2~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

  • [node-https-proxy-agent]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 7.0.4~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

    • 7.0.4~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

  • [node-pac-proxy-agent]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 7.0.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

    • 7.0.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

  • [node-pac-resolver]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 7.0.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

    • 7.0.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

  • [node-proxy]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 2.1.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

    • 2.1.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

  • [node-proxy-agent]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 6.4.0~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

    • 6.4.0~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

  • [node-socks-proxy-agent]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 8.0.3~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

    • 8.0.3~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]