{"action":"Upgrade basic-ftp to 6.2.1 or later.","affected":[{"fixed":"6.2.1","introduced":"0"}],"component":"basic-ftp","cve_ids":["CVE-2026-102990"],"ecosystem":"npm","epss":0.0037,"exploited":false,"fixed_versions":["6.2.1"],"ghsa_id":"GHSA-c475-qrg2-pj4r","id":"tcs_01M5KFHNE9B1RGJ8WDQXXHHTRG","modified_at":"2026-10-01T15:00:04.517943812Z","published_at":"2026-10-01T14:42:42Z","references":["https://osv.dev/vulnerability/GHSA-c475-qrg2-pj4r","https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-c475-qrg2-pj4r","https://nvd.nist.gov/vuln/detail/CVE-2026-102990","https://github.com/patrickjuchli/basic-ftp/commit/d0d9e07c56e519587bb50532ac6eadbb0cb0cfe9","https://github.com/patrickjuchli/basic-ftp","https://github.com/patrickjuchli/basic-ftp/releases/tag/v6.2.1"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"GHSA-c475-qrg2-pj4r","url":"https://osv.dev/vulnerability/GHSA-c475-qrg2-pj4r"},{"source":"nvd","source_id":"CVE-2026-102990","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102990"}],"summary":"basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)"}