Homepage

basic-ftp@4.5.2

FTP client for Node.js, supports FTPS over TLS, IPv6, Async/Await, and Typescript.

  • latest version

    6.0.1

  • latest non vulnerable version

    6.0.1

  • first published

    8 years ago

  • latest version published

    1 months ago

  • licenses detected

  • View basic-ftp package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the basic-ftp package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Allocation of Resources Without Limits or Throttling

    basic-ftp is a FTP client for Node.js, supports FTPS over TLS, IPv6, Async/Await, and Typescript.

    Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the connect function. An attacker can cause excessive memory and CPU consumption, leading to application unavailability or service degradation, by sending an unterminated multiline FTP control response from a malicious or compromised FTP server before authentication. No user interaction or valid credentials are required for exploitation.

    How to fix Allocation of Resources Without Limits or Throttling?

    Upgrade basic-ftp to version 5.3.1 or higher.

    <5.3.1
    • H
    Allocation of Resources Without Limits or Throttling

    basic-ftp is a FTP client for Node.js, supports FTPS over TLS, IPv6, Async/Await, and Typescript.

    Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the StringWriter method. An attacker can cause excessive memory consumption and potential process termination by sending an extremely large or unbounded directory listing response from a malicious or compromised FTP server.

    How to fix Allocation of Resources Without Limits or Throttling?

    Upgrade basic-ftp to version 5.3.0 or higher.

    <5.3.0
    • H
    CRLF Injection

    basic-ftp is a FTP client for Node.js, supports FTPS over TLS, IPv6, Async/Await, and Typescript.

    Affected versions of this package are vulnerable to CRLF Injection via the login and _openDir methods. An attacker can execute arbitrary FTP commands by injecting control characters into credentials or directory names sent to the FTP server.

    Note: This vulnerability extends the incomplete fix for CVE-2026-39983.

    How to fix CRLF Injection?

    Upgrade basic-ftp to version 5.2.2 or higher.

    <5.2.2
    • C
    CRLF Injection

    basic-ftp is a FTP client for Node.js, supports FTPS over TLS, IPv6, Async/Await, and Typescript.

    Affected versions of this package are vulnerable to CRLF Injection via unsanitized path parameters in the protectWhitespace function. An attacker can execute arbitrary FTP commands by injecting CRLF sequences into file path inputs, which are then interpreted as separate commands by the FTP server. This can lead to unauthorized file deletion, directory manipulation, file exfiltration, command execution on supporting servers, session hijacking, or service disruption.

    How to fix CRLF Injection?

    Upgrade basic-ftp to version 5.2.1 or higher.

    <5.2.1
    • H
    Directory Traversal

    basic-ftp is a FTP client for Node.js, supports FTPS over TLS, IPv6, Async/Await, and Typescript.

    Affected versions of this package are vulnerable to Directory Traversal in the downloadToDir() method. A malicious FTP server can overwrite or create files outside the intended directory.

    How to fix Directory Traversal?

    Upgrade basic-ftp to version 5.2.0 or higher.

    <5.2.0
    Go back to all versions of this package