6 matches found
CVE-2026-126346
basic-ftp is an FTP client for Node.js. Prior to 6.2.3, FTPContext.send throws when a command contains carriage return, line feed, or NUL characters, but calls made from response handlers execute synchronously inside the control socket's data event without an exception boundary. In Client.login, ...
EUVD-2026-124724
basic-ftp is an FTP client for Node.js. Prior to 6.2.3, FTPContext.send throws when a command contains carriage return, line feed, or NUL characters, but calls made from response handlers execute synchronously inside the control socket's data event without an exception boundary. In Client.login, ...
CVE-2026-126346
The basic-ftp Node.js FTP client is vulnerable to a Denial of Service (DoS) via an uncaught exception in versions prior to 6.2.3 . The root cause is that FTPContext.send() throws an exception when encountering carriage return, line feed, or NUL characters in a command. Because response handlers e...
CVE-2026-126346 basic-ftp: Uncaught exception crashes the Node.js process when a password (or resumed-download path) contains CR/LF
basic-ftp is an FTP client for Node.js. Prior to 6.2.3, FTPContext.send throws when a command contains carriage return, line feed, or NUL characters, but calls made from response handlers execute synchronously inside the control socket's data event without an exception boundary. In Client.login, ...
CVE-2026-126346: patrickjuchli basic-ftp: basic-ftp is an FTP client for Node.js
basic-ftp is an FTP client for Node.js. Prior to 6.2.3, FTPContext.send throws when a command contains carriage return, line feed, or NUL characters, but calls made from response handlers execute synchronously inside the control socket's data event without an exception boundary. In Client.login, ...
PT-2026-146066
Summary Client.login calls FTPContext.send from inside the control-socket data event handler. send throws on CR, LF or NUL, and nothing catches the throw. A password containing r therefore raises an uncaught exception and terminates the whole Node.js process. It does not reject the returned...