Skip to content
OpenAdvisories
High · 7.5 CVE-2026-41324 EUVD-2026-25390GHSA-rp42-5vxx-qpwr

basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()

Published Apr 24, 2026 · Updated Apr 24, 2026 · Assigned by GitHub_M

Description

basic-ftp is an FTP client for Node.js. Versions prior to 5.3.0 are vulnerable to denial of service through unbounded memory growth while processing directory listings from a remote FTP server. A malicious or compromised server can send an extremely large or never-ending listing response to `Client.list()`, causing the client process to consume memory until it becomes unstable or crashes. Version 5.3.0 fixes the issue.

Affected products

VendorProductAffectedFixed
patrickjuchli basic-ftp < 5.3.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 node-proxy-agents 0~2025070717+~cs15.3.7-1 —
Debian 13 node-proxy-agents No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 node-proxy-agents No fix yet —
Ubuntu 26.04 LTS node-proxy-agents No fix yet —
Ubuntu 25.10 node-proxy-agents No fix yet —
Ubuntu 24.04 LTS node-proxy-agents No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling code-server 4.112.0-r3 —
Wolfi rolling opensearch-dashboards-3-security-dashboards-plugin 3.6.0-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm basic-ftp < 5.3.0 5.3.0 GHSA-rp42-5vxx-qpwr

Advisories 2

References