CVE-2026-41324: basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()
basic-ftp is an FTP client for Node.js. Versions prior to 5.3.0 are vulnerable to denial of service through unbounded memory growth while processing directory listings from a remote FTP server. A malicious or compromised server can send an extremely large or never-ending listing response to Client.list(), causing the client process to consume memory until it becomes unstable or crashes. Version 5.3.0 fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
basic-ftpto a version that resolves this vulnerability.Fixed in 5.3.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41324?
CVE-2026-41324 is classified as a denial of service vulnerability due to unbounded memory consumption.
How do I fix CVE-2026-41324?
To fix CVE-2026-41324, upgrade basic-ftp to version 5.3.0 or later.
What versions of basic-ftp are affected by CVE-2026-41324?
Versions of basic-ftp prior to 5.3.0 are affected by CVE-2026-41324.
What is the impact of CVE-2026-41324 on applications?
CVE-2026-41324 can lead to denial of service in applications using affected versions of basic-ftp.
How can I detect if my application is vulnerable to CVE-2026-41324?
You can detect vulnerability to CVE-2026-41324 by checking if your application uses basic-ftp version less than 5.3.0.