REDHAT-BUG-2476813: High severity npm/basic-ftp vulnerability

Q: Which applications are realistically exposed to this issue?

Applications using basic-ftp to automatically connect to FTP endpoints are exposed if they connect to a malicious or compromised server. The affected behavior occurs during the initial FTP banner phase, before authentication.

Q: What does an attacker need to exploit the vulnerability?

An attacker needs to control, compromise, or otherwise cause the client to connect to an FTP server that sends an unterminated multiline control-channel response. No FTP authentication is required because exploitation happens when the client receives the initial banner.

Q: How can we tell whether a service is being affected?

Affected clients can remain stuck in connect() while memory and CPU consumption grows. Operational signs can include process-level denial of service, container OOM kills, worker restarts, queue backlog, and service degradation.

Q: What version fixes the issue?

The vulnerability is fixed in basic-ftp version 5.3.1. Versions prior to 5.3.1 are affected.

Published May 12, 2026

Updated

basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is vulnerable to client-side denial of service when parsing FTP control-channel multiline responses. A malicious or compromised FTP server can send an unterminated multiline response during the initial FTP banner phase, before authentication. The client keeps appending attacker-controlled data into FtpContext.partialResponse and repeatedly reparses the accumulated buffer without enforcing a maximum control response size. As a result, an application using basic-ftp can remain stuck in connect() while memory and CPU usage grow under attacker-controlled input. This can lead to process-level denial of service, container OOM kills, worker restarts, queue backlog, or service degradation in applications that automatically connect to FTP endpoints. This vulnerability is fixed in 5.3.1.

Affected Software

1 affected component

npm/basic-ftp<5.3.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade basic-ftp to a version that resolves this vulnerability.
Fixed in 5.3.1

Event History

May 12, 2026

Data Sourced

via Red Hat·09:02 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which applications are realistically exposed to this issue?

Applications using basic-ftp to automatically connect to FTP endpoints are exposed if they connect to a malicious or compromised server. The affected behavior occurs during the initial FTP banner phase, before authentication.

What does an attacker need to exploit the vulnerability?

An attacker needs to control, compromise, or otherwise cause the client to connect to an FTP server that sends an unterminated multiline control-channel response. No FTP authentication is required because exploitation happens when the client receives the initial banner.

How can we tell whether a service is being affected?