AIKIDO-2026-221764

TL;DR

basic-ftp's MLSD directory listing detector and PASV response parser use regular expressions that backtrack quadratically on crafted FTP server input. A listing line of repeated = characters with no ;, or a 227 PASV reply with a long run of digits and no commas, makes the regex engine retry every split point and blocks the Node.js event loop for seconds. Both inputs come directly from the connected FTP server, so a malicious or compromised server can freeze the client application during list() or a passive mode transfer. The fix excludes = from MLSD fact names and adds a lookbehind in the PASV parser so neither regex retries at every character.