Your message dated Mon, 05 Oct 2026 09:05:25 +0000
with message-id <[email protected]>
and subject line Bug#1149908: fixed in node-proxy-agents
0~2025070717+~cs16.2.9-1
has caused the Debian Bug report #1149908,
regarding node-proxy-agents: CVE-2026-102990
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1149908: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1149908
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: node-proxy-agents
Version: 0~2025070717+~cs15.3.8-3
X-Debbugs-CC: [email protected]
Severity: important
Tags: security upstream
Hi,
The following vulnerability was published for node-proxy-agents.
CVE-2026-102990[0]:
| basic-ftp is an FTP client for Node.js. Prior to 6.2.1,
| Client.list() can be forced by a malicious or compromised FTP server
| to spend quadratic CPU time parsing a directory listing because the
| RE_LINE expression in src/parseListUnix.ts backtracks across
| adjacent variable-length owner and group fields when a long Unix-
| style line has a valid prefix but cannot satisfy the later size and
| date fields. parseList() selects a parser from the last nonblank
| line and then applies it to every line, so a normal final line can
| select the Unix parser while an earlier crafted line blocks the
| Node.js event loop and freezes the process. This issue is fixed in
| version 6.2.1.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-102990
https://www.cve.org/CVERecord?id=CVE-2026-102990
[1]
https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-c475-qrg2-pj4r
[2]
https://github.com/patrickjuchli/basic-ftp/commit/d0d9e07c56e519587bb50532ac6eadbb0cb0cfe9
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: node-proxy-agents
Source-Version: 0~2025070717+~cs16.2.9-1
Done: Xavier Guimard <[email protected]>
We believe that the bug you reported is fixed in the latest version of
node-proxy-agents, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Xavier Guimard <[email protected]> (supplier of updated node-proxy-agents package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 05 Oct 2026 09:55:55 +0200
Source: node-proxy-agents
Architecture: source
Version: 0~2025070717+~cs16.2.9-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Javascript Maintainers
<[email protected]>
Changed-By: Xavier Guimard <[email protected]>
Closes: 1149908
Changes:
node-proxy-agents (0~2025070717+~cs16.2.9-1) unstable; urgency=medium
.
* Team upload
* New upstream version 0~2025070717+~cs16.2.9: basic-ftp 6.2.2
(Closes: #1149908, CVE-2026-102990)
* Run basic-ftp unit tests in autopkgtest
Checksums-Sha1:
ea0b6ff0d7315a697d47446e93852a3d4a6878bb 4487
node-proxy-agents_0~2025070717+~cs16.2.9-1.dsc
7d35204244f0477cba2be82bc20b5373638473af 58360
node-proxy-agents_0~2025070717+~cs16.2.9.orig-args.tar.xz
777eb5fd7dbfbf4864fbac6145ee68f19760b4c9 85944
node-proxy-agents_0~2025070717+~cs16.2.9.orig-basic-ftp.tar.xz
45f6d4e3467ceeadc2938cc272dd3a533d46dc2b 1948
node-proxy-agents_0~2025070717+~cs16.2.9.orig-types-args.tar.xz
2b361627ea55f5e78e13034fc6b171a01298ee27 208396
node-proxy-agents_0~2025070717+~cs16.2.9.orig.tar.xz
ddfbc847b7f3eb0cf6fc17e50d9a3f10f12d9d7b 49608
node-proxy-agents_0~2025070717+~cs16.2.9-1.debian.tar.xz
Checksums-Sha256:
275f78e4400b2bdfa9f96155d7142b1242f9b91e951043973418a545b90bc6ea 4487
node-proxy-agents_0~2025070717+~cs16.2.9-1.dsc
a6e8d2f8ae740b299b66071251575bd4e69af91ff5ddf32fe323b83e16a8fb77 58360
node-proxy-agents_0~2025070717+~cs16.2.9.orig-args.tar.xz
f3d3aedfee8b8e663e75ccc8d73acf21e6d4727df0ad824bcf3174c0f112e31e 85944
node-proxy-agents_0~2025070717+~cs16.2.9.orig-basic-ftp.tar.xz
86b7beed4803048ff50732536dc4d6283b13120c617cbd3dd5831e004d8cce34 1948
node-proxy-agents_0~2025070717+~cs16.2.9.orig-types-args.tar.xz
ec93ca1ce8d64d056f05fefa76ca9a4d1fc12575cb28dc4ba2123d91b242ff92 208396
node-proxy-agents_0~2025070717+~cs16.2.9.orig.tar.xz
5417c9f2083361e791c2d32bf1e569715d9cd67b3c6963b543a72272137167af 49608
node-proxy-agents_0~2025070717+~cs16.2.9-1.debian.tar.xz
Files:
f5ba49d21315d12bf7fdb3fd4518dfad 4487 javascript optional
node-proxy-agents_0~2025070717+~cs16.2.9-1.dsc
c93c1f90ee4d496ee08324f96f93ace8 58360 javascript optional
node-proxy-agents_0~2025070717+~cs16.2.9.orig-args.tar.xz
4bfd6bf85547ad16e37145ac7cf271c7 85944 javascript optional
node-proxy-agents_0~2025070717+~cs16.2.9.orig-basic-ftp.tar.xz
8e0052d60d18d531dddb3eb1d0e2479c 1948 javascript optional
node-proxy-agents_0~2025070717+~cs16.2.9.orig-types-args.tar.xz
e8642b6014de7e6afc920112cc8aeabe 208396 javascript optional
node-proxy-agents_0~2025070717+~cs16.2.9.orig.tar.xz
99a0ecd1d9ebd7dc99b85a3aaf015060 49608 javascript optional
node-proxy-agents_0~2025070717+~cs16.2.9-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmrDWIIACgkQ9tdMp8mZ
7umiVw//Udde3KrEX2X1QAf+SeQGh+LCTgy+t1vsHaUwx8AwjgfX1DDTMZJvdpNT
SMXOq81BCgQXFely8Xn/uQ+7FsUmzxxpyYbuYF3YSzkso8XJJH1iNWKml0Puy+Zl
cGBhpU8+pEz52dqfwvcZxwD6aaKokvBe8XwsVD79Fo9o1ZkwizkyPvbU0eY+RnIX
ku7yIky7qQhJQKUiUmNNzUYkKU6s0QsdVGAg9gX2xGfMcQw0hUcP56+9DUJOCsJN
trk7TsVgcL+rEpvZYNJXxHqvPI2VC7H0Au3Gzv4J51+VnPqJPOHzK7TwXvhn26nx
klHdt6ShKNkbc4Sr93/w0kwrWc9S2pzwynzhYhqf3aJC8x/C/wlF6f4emJhAlVzq
Tl1d2dEb19kyT5lfEnpKxeDfGqV6TrH6AU0Skf+xs0IoIwoXHrD7hSSoMv3g9Syc
k965nFbJmtrJtOCZxilvMnkYN8Uo6bxdy3sfsYApKvNTNcfNtw40/j2FAe9Tu85K
2rQhdOw0lvQ8aZNtATLQLneQIaUVl976F6AYFTHglCO7YOT3t28EMoCmX4XVkt7n
OGACqkCAz+VF5FwHCEAbHbsI2yBdV32vODf0RJnTwNvfspo9AmtvlnBpHX+kNcSf
g4DllDHL6a/5zdUfHAxZhSVD/9dbUdWnumxKz2Zwed3jbZFNMEA=
=kUWy
-----END PGP SIGNATURE-----
pgpHteXs1qr4W.pgp
Description: PGP signature
--- End Message ---
--
Pkg-javascript-devel mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
