basic-ftp: ReDoS Vulnerability in Unix Directory Listing Parser Allows Remote CPU Exhaustion

What Happened

A regular expression denial of service (ReDoS) vulnerability was identified in basic-ftp, an FTP client library for Node.js. The flaw resides in the Unix directory-listing parser, where a specific regular expression (RE_LINE) used in src/parseListUnix.ts can be forced into catastrophic backtracking. When a long Unix-style directory listing line has a valid prefix but fails to satisfy the later size and date fields, the regex engine spends quadratic time attempting to match adjacent variable-length owner and group fields.

Technical Cause

The root cause lies in how basic-ftp's parseList() function selects a parser. It inspects the last nonblank line of a directory listing to choose which format parser to apply, then applies that same parser to every line in the listing. This means a normal, well-formed final line can cause the Unix parser to be selected, while an earlier line in the same listing — crafted by a malicious server — triggers catastrophic backtracking in the RE_LINE expression. Because Client.list() parses every line with this selected parser, a single malicious entry anywhere in the listing is sufficient to block the Node.js event loop.

Why It Matters

Because the vulnerability can be triggered remotely by the FTP server without any authentication or user interaction beyond issuing a listing request, it poses a denial-of-service risk to any Node.js application that connects to FTP servers it does not fully control or trust. A single crafted response can freeze the event loop, effectively halting processing for the affected application until the CPU-bound operation completes or the process is restarted.

Who Is Affected

Any application using the basic-ftp npm package to connect to FTP servers is potentially affected if that server is malicious or has been compromised. This is particularly relevant for applications that connect to third-party or less-trusted FTP servers, since the attack is initiated by the server's response to a listing command.

Affected Versions

All versions of basic-ftp from 0 up to and including 6.2.0 are affected. The vulnerability is fixed in version 6.2.1.

Fixes and Mitigation

The vendor has released basic-ftp version 6.2.1, which fixes the RE_LINE backtracking issue in the Unix directory-listing parser. No other mitigations are described in the available fact package.

Recommended Action

Update the basic-ftp npm package to version 6.2.1 or later as soon as possible. Applications that connect to FTP servers outside their direct control should prioritize this update given the remote, unauthenticated nature of the trigger.