EUVD-2026-124724

basic-ftp is an FTP client for Node.js. Prior to 6.2.3, FTPContext.send throws when a command contains carriage return, line feed, or NUL characters, but calls made from response handlers execute synchronously inside the control socket's data event without an exception boundary. In Client.login, ...

CVE-2026-126346

The basic-ftp Node.js FTP client is vulnerable to a Denial of Service (DoS) via an uncaught exception in versions prior to 6.2.3 . The root cause is that FTPContext.send() throws an exception when encountering carriage return, line feed, or NUL characters in a command. Because response handlers e...