Hi,

The following vulnerability was published for node-proxy-agents.

CVE-2026-102990[0]:
| basic-ftp is an FTP client for Node.js. Prior to 6.2.1,
| Client.list() can be forced by a malicious or compromised FTP server
| to spend quadratic CPU time parsing a directory listing because the
| RE_LINE expression in src/parseListUnix.ts backtracks across
| adjacent variable-length owner and group fields when a long Unix-
| style line has a valid prefix but cannot satisfy the later size and
| date fields. parseList() selects a parser from the last nonblank
| line and then applies it to every line, so a normal final line can
| select the Unix parser while an earlier crafted line blocks the
| Node.js event loop and freezes the process. This issue is fixed in
| version 6.2.1.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-102990
https://www.cve.org/CVERecord?id=CVE-2026-102990
[1] https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-c475-qrg2-pj4r
[2] https://github.com/patrickjuchli/basic-ftp/commit/d0d9e07c56e519587bb50532ac6eadbb0cb0cfe9

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
node-proxy-agents, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1149908@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Xavier Guimard <yadd@debian.org> (supplier of updated node-proxy-agents package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 05 Oct 2026 09:55:55 +0200
Source: node-proxy-agents
Architecture: source
Version: 0~2025070717+~cs16.2.9-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>
Changed-By: Xavier Guimard <yadd@debian.org>
Closes: 1149908
Changes:
 node-proxy-agents (0~2025070717+~cs16.2.9-1) unstable; urgency=medium
 .
   * Team upload
   * New upstream version 0~2025070717+~cs16.2.9: basic-ftp 6.2.2
     (Closes: #1149908, CVE-2026-102990)
   * Run basic-ftp unit tests in autopkgtest
Checksums-Sha1:
 ea0b6ff0d7315a697d47446e93852a3d4a6878bb 4487 node-proxy-agents_0~2025070717+~cs16.2.9-1.dsc
 7d35204244f0477cba2be82bc20b5373638473af 58360 node-proxy-agents_0~2025070717+~cs16.2.9.orig-args.tar.xz
 777eb5fd7dbfbf4864fbac6145ee68f19760b4c9 85944 node-proxy-agents_0~2025070717+~cs16.2.9.orig-basic-ftp.tar.xz
 45f6d4e3467ceeadc2938cc272dd3a533d46dc2b 1948 node-proxy-agents_0~2025070717+~cs16.2.9.orig-types-args.tar.xz
 2b361627ea55f5e78e13034fc6b171a01298ee27 208396 node-proxy-agents_0~2025070717+~cs16.2.9.orig.tar.xz
 ddfbc847b7f3eb0cf6fc17e50d9a3f10f12d9d7b 49608 node-proxy-agents_0~2025070717+~cs16.2.9-1.debian.tar.xz
Checksums-Sha256:
 275f78e4400b2bdfa9f96155d7142b1242f9b91e951043973418a545b90bc6ea 4487 node-proxy-agents_0~2025070717+~cs16.2.9-1.dsc
 a6e8d2f8ae740b299b66071251575bd4e69af91ff5ddf32fe323b83e16a8fb77 58360 node-proxy-agents_0~2025070717+~cs16.2.9.orig-args.tar.xz
 f3d3aedfee8b8e663e75ccc8d73acf21e6d4727df0ad824bcf3174c0f112e31e 85944 node-proxy-agents_0~2025070717+~cs16.2.9.orig-basic-ftp.tar.xz
 86b7beed4803048ff50732536dc4d6283b13120c617cbd3dd5831e004d8cce34 1948 node-proxy-agents_0~2025070717+~cs16.2.9.orig-types-args.tar.xz
 ec93ca1ce8d64d056f05fefa76ca9a4d1fc12575cb28dc4ba2123d91b242ff92 208396 node-proxy-agents_0~2025070717+~cs16.2.9.orig.tar.xz
 5417c9f2083361e791c2d32bf1e569715d9cd67b3c6963b543a72272137167af 49608 node-proxy-agents_0~2025070717+~cs16.2.9-1.debian.tar.xz
Files:
 f5ba49d21315d12bf7fdb3fd4518dfad 4487 javascript optional node-proxy-agents_0~2025070717+~cs16.2.9-1.dsc
 c93c1f90ee4d496ee08324f96f93ace8 58360 javascript optional node-proxy-agents_0~2025070717+~cs16.2.9.orig-args.tar.xz
 4bfd6bf85547ad16e37145ac7cf271c7 85944 javascript optional node-proxy-agents_0~2025070717+~cs16.2.9.orig-basic-ftp.tar.xz
 8e0052d60d18d531dddb3eb1d0e2479c 1948 javascript optional node-proxy-agents_0~2025070717+~cs16.2.9.orig-types-args.tar.xz
 e8642b6014de7e6afc920112cc8aeabe 208396 javascript optional node-proxy-agents_0~2025070717+~cs16.2.9.orig.tar.xz
 99a0ecd1d9ebd7dc99b85a3aaf015060 49608 javascript optional node-proxy-agents_0~2025070717+~cs16.2.9-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmrDWIIACgkQ9tdMp8mZ
7umiVw//Udde3KrEX2X1QAf+SeQGh+LCTgy+t1vsHaUwx8AwjgfX1DDTMZJvdpNT
SMXOq81BCgQXFely8Xn/uQ+7FsUmzxxpyYbuYF3YSzkso8XJJH1iNWKml0Puy+Zl
cGBhpU8+pEz52dqfwvcZxwD6aaKokvBe8XwsVD79Fo9o1ZkwizkyPvbU0eY+RnIX
ku7yIky7qQhJQKUiUmNNzUYkKU6s0QsdVGAg9gX2xGfMcQw0hUcP56+9DUJOCsJN
trk7TsVgcL+rEpvZYNJXxHqvPI2VC7H0Au3Gzv4J51+VnPqJPOHzK7TwXvhn26nx
klHdt6ShKNkbc4Sr93/w0kwrWc9S2pzwynzhYhqf3aJC8x/C/wlF6f4emJhAlVzq
Tl1d2dEb19kyT5lfEnpKxeDfGqV6TrH6AU0Skf+xs0IoIwoXHrD7hSSoMv3g9Syc
k965nFbJmtrJtOCZxilvMnkYN8Uo6bxdy3sfsYApKvNTNcfNtw40/j2FAe9Tu85K
2rQhdOw0lvQ8aZNtATLQLneQIaUVl976F6AYFTHglCO7YOT3t28EMoCmX4XVkt7n
OGACqkCAz+VF5FwHCEAbHbsI2yBdV32vODf0RJnTwNvfspo9AmtvlnBpHX+kNcSf
g4DllDHL6a/5zdUfHAxZhSVD/9dbUdWnumxKz2Zwed3jbZFNMEA=
=kUWy
-----END PGP SIGNATURE-----