GHSA-rpmf-866q-6p89
High · 7.5CVSS
7.5
EPSS
—
Published
May 6, 2026
CISA due date
—
The record
basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | basic-ftp | 0 | 5.3.1 |
Related vulnerabilities
- CVE-2026-44240 basic-ftp is an FTP client for Node.js. Same vulnerability
- CVE-2026-41324 basic-ftp is an FTP client for Node.js. Also affects basic-ftp
- GHSA-rp42-5vxx-qpwr basic-ftp vulnerable to denial of service via unbounded memory consumption in… Also affects basic-ftp
- GHSA-6v7q-wjvx-w8wg basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution… Also affects basic-ftp
- GHSA-5rq4-664w-9x2c Basic FTP has Path Traversal Vulnerability in its downloadToDir() method Also affects basic-ftp
- CVE-2026-27699 The `basic-ftp` FTP client library for Node.js contains a path traversal vulnerability… Also affects basic-ftp
- CVE-2026-113795 pypdf is a free and open-source pure-python PDF library. CWE-400
- CVE-2026-83400 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise… CWE-400