basic-ftp

### Summary basic-ftp's MLSD directory-listing parser (src/parseListMLSD.ts) looks up fact-handler functions in a plain object literal keyed directly by fact names taken from the FTP server's response, with no validation. A directory-listing line containing the fact name "__proto__" resolves this lookup to Object.prototype (inherited, non-own, non-function) instead of undefined, so the "not a function" guard is bypassed and the code throws `TypeError: factHandler is not a function`. This TypeError is not an FTPError, so it is not caught by Client.list()'s retry logic and propagates as a reje

CVE: CVE-2026-126345

### Summary Client.login() calls FTPContext.send() from inside the control-socket data event handler. send() throws on CR, LF or NUL, and nothing catches the throw. A password containing \r\n therefore raises an uncaught exception and terminates the whole Node.js process. It does not reject the returned promise. Any application that passes untrusted input as the FTP password can be crashed remotely with one request. The same pattern exists in the REST/RETR path of downloadTo() when the remote path contains control characters. ### Details The CRLF guard (FTPContext.send, src/FtpContext.ts ~L

CVE: CVE-2026-126346

## Summary `Client.list()` parses the server's directory listing with the Unix-style parser in `parseListUnix.js`. Its `RE_LINE` regex has two adjacent `(\S+(?:\s\S+)*)` groups (owner name, then group name) followed by a required numeric size group. When a line starts with a valid listing prefix but the tokens after it never satisfy the size and date fields, the engine backtracks over every way of splitting those tokens between the two groups before it can fail, so matching one line costs roughly O(n²) in the line's length. The server whose directory a client lists controls that listing, so

CVE: CVE-2026-102990

## Summary `basic-ftp` is vulnerable to client-side denial of service when parsing FTP control-channel multiline responses. A malicious or compromised FTP server can send an unterminated multiline response during the initial FTP banner phase, before authentication. The client keeps appending attacker-controlled data into `FtpContext._partialResponse` and repeatedly reparses the accumulated buffer without enforcing a maximum control response size. As a result, an application using `basic-ftp` can remain stuck in `connect()` while memory and CPU usage grow under attacker-controlled input. Thi

CVE: CVE-2026-44240

### Summary `basic-ftp@5.2.2` is vulnerable to denial of service through unbounded memory growth while processing directory listings from a remote FTP server. A malicious or compromised server can send an extremely large or never-ending listing response to `Client.list()`, causing the client process to consume memory until it becomes unstable or crashes. ### Details The issue is in the package's default directory listing flow. `Client.list()` reaches `dist/Client.js`, where the full listing response is downloaded into a `StringWriter` before parsing: File: `dist/Client.js:516-527` ```js as

CVE: CVE-2026-41324

## Summary basic-ftp's CRLF injection protection (added in commit 2ecc8e2 for GHSA-chqc-8p9q-pq6q) is incomplete. Two code paths bypass the `protectWhitespace()` control character check: (1) the `login()` method directly concatenates user-supplied credentials into USER/PASS FTP commands without any validation, and (2) the `_openDir()` method sends an MKD command before `cd()` invokes `protectWhitespace()`, creating a TOCTOU bypass. Both vectors allow an attacker who controls input to inject arbitrary FTP commands into the control connection. ## Details ### Vector 1: Credential Injection (lo

## Summary `basic-ftp` version `5.2.0` allows FTP command injection via CRLF sequences (`\r\n`) in file path parameters passed to high-level path APIs such as `cd()`, `remove()`, `rename()`, `uploadFrom()`, `downloadTo()`, `list()`, and `removeDir()`. The library's `protectWhitespace()` helper only handles leading spaces and returns other paths unchanged, while `FtpContext.send()` writes the resulting command string directly to the control socket with `\r\n` appended. This lets attacker-controlled path strings split one intended FTP command into multiple commands. ## Affected product | Prod

CVE: CVE-2026-39983

The `basic-ftp` library contains a path traversal vulnerability in the `downloadToDir()` method. A malicious FTP server can send directory listings with filenames containing path traversal sequences (`../`) that cause files to be written outside the intended download directory. ## Source-to-Sink Flow ``` 1. SOURCE: FTP server sends LIST response └─> "-rw-r--r-- 1 user group 1024 Jan 20 12:00 ../../../etc/passwd" 2. PARSER: parseListUnix.ts:100 extracts filename └─> file.name = "../../../etc/passwd" 3. VALIDATION: parseListUnix.ts:101 checks └─> if (name === "." || name === "..") ❌ (only f

CVE: CVE-2026-27699