CRLF Injection Affecting basic-ftp package, versions <5.2.2
Threat Intelligence
Exploit Maturity
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Proof of Concept
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-BASICFTP-15989098
- published12 Apr 2026
- disclosed10 Apr 2026
- creditoffset
Introduced: 10 Apr 2026
New CVE NOT AVAILABLE CWE-93 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade basic-ftp to version 5.2.2 or higher.
Overview
basic-ftp is a FTP client for Node.js, supports FTPS over TLS, IPv6, Async/Await, and Typescript.
Affected versions of this package are vulnerable to CRLF Injection via the login and _openDir methods. An attacker can execute arbitrary FTP commands by injecting control characters into credentials or directory names sent to the FTP server.
Note: This vulnerability extends the incomplete fix for CVE-2026-39983.