basic-ftp

npm · Package

8 reports

Vulnerability alerts

Report	Product	Ecosystem	Severity	Fix status	Last updated
basic-ftp: Uncaught exception crashes the Node.js process when a password (or resumed-download path) contains CR/LFCVE-2026-126346 · GHSA-R4JH-29PC-GFQR	basic-ftp	npm	Medium	Fix reported	2026-11-13
basic-ftp: Uncaught TypeError in MLSD directory-listing parser via __proto__ fact name causes DoS in Client.list()CVE-2026-126345 · GHSA-5PM8-86M8-9M6R	basic-ftp	npm	Medium	Fix reported	2026-11-13
basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)CVE-2026-102990 · GHSA-C475-QRG2-PJ4R	basic-ftp Red Hat Enterprise Linux AI (RHEL AI) 3/rust	npmRed Hat	High	Fix reported	2026-10-01
basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response bufferingCVE-2026-44240 · GHSA-RPMF-866Q-6P89	basic-ftp Red Hat Developer Hub 1/rhdh/rhdh-hub-rhel9	npmRed Hat	High	Fix reported	2026-09-10
basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()CVE-2026-41324 · GHSA-RP42-5VXX-QPWR	basic-ftp Red Hat Developer Hub 1/rhdh/rhdh-hub-rhel9	npmRed Hat	High	Fix reported	2026-09-10
basic-ftp has FTP Command Injection via CRLFCVE-2026-39983 · GHSA-CHQC-8P9Q-PQ6Q	basic-ftp Self-service automation portal 2/redhat-user-workloads/ansible-plugins	npmRed Hat	High	Fix reported	2026-09-10
basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD CommandsGHSA-6V7Q-WJVX-W8WG	basic-ftp	npm	High	Fix reported	2026-09-10
Basic FTP has Path Traversal Vulnerability in its downloadToDir() methodCVE-2026-27699 · GHSA-5RQ4-664W-9X2C	basic-ftp	npm	Critical	Fix reported	2026-09-10