basic-ftp: Uncaught exception crashes the Node.js process when a password (or resumed-download path) contains CR/LF

Summary Client.login calls FTPContext.send from inside the control-socket data event handler. send throws on CR, LF or NUL, and nothing catches the throw. A password containing \r\n therefore raises an uncaught exception and terminates the whole Node.js process. It does not reject the returned...

GHSA-R4JH-29PC-GFQR basic-ftp: Uncaught exception crashes the Node.js process when a password (or resumed-download path) contains CR/LF

Summary Client.login calls FTPContext.send from inside the control-socket data event handler. send throws on CR, LF or NUL, and nothing catches the throw. A password containing \r\n therefore raises an uncaught exception and terminates the whole Node.js process. It does not reject the returned...

CVE-2026-126346

basic-ftp is an FTP client for Node.js. Prior to 6.2.3, FTPContext.send throws when a command contains carriage return, line feed, or NUL characters, but calls made from response handlers execute synchronously inside the control socket's data event without an exception boundary. In Client.login, ...

CVE-2026-126346 basic-ftp: Uncaught exception crashes the Node.js process when a password (or resumed-download path) contains CR/LF

basic-ftp is an FTP client for Node.js. Prior to 6.2.3, FTPContext.send throws when a command contains carriage return, line feed, or NUL characters, but calls made from response handlers execute synchronously inside the control socket's data event without an exception boundary. In Client.login, ...

PT-2026-146066

Summary Client.login calls FTPContext.send from inside the control-socket data event handler. send throws on CR, LF or NUL, and nothing catches the throw. A password containing r therefore raises an uncaught exception and terminates the whole Node.js process. It does not reject the returned...