CLSA-2026-1794585407 TuxCare security update for basic-ftp (2 CVEs)

TuxCare rebuilt basic-ftp to address 2 CVEs. Fixed in 5.3.0-tuxcare.1...

CLSA-2026-1794562919 TuxCare security update for basic-ftp (2 CVEs)

TuxCare rebuilt basic-ftp to address 2 CVEs. Fixed in 5.3.1-tuxcare.3...

CVE-2026-39983

References https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-chqc-8p9q-pq6q https://github.com/patrickjuchli/basic-ftp/commit/2ecc8e2c500c5234115f06fd1dbde1aa03d70f4b https://github.com/patrickjuchli/basic-ftp/releases/tag/v5.2.1...

basic-ftp: Uncaught exception crashes the Node.js process when a password (or resumed-download path) contains CR/LF

Summary Client.login calls FTPContext.send from inside the control-socket data event handler. send throws on CR, LF or NUL, and nothing catches the throw. A password containing \r\n therefore raises an uncaught exception and terminates the whole Node.js process. It does not reject the returned...

npm: basic-ftp: Uncaught exception crashes the Node.js process when a password (or resumed-download path) contains CR/LF

npm: basic-ftp: Uncaught exception crashes the Node.js process when a password or resumed-download path contains CR/LF vulnerability discovered by ? in WordPress npm basic-ftp versions = 6.2.2...

GHSA-R4JH-29PC-GFQR basic-ftp: Uncaught exception crashes the Node.js process when a password (or resumed-download path) contains CR/LF

Summary Client.login calls FTPContext.send from inside the control-socket data event handler. send throws on CR, LF or NUL, and nothing catches the throw. A password containing \r\n therefore raises an uncaught exception and terminates the whole Node.js process. It does not reject the returned...

CVE-2026-126346

basic-ftp is an FTP client for Node.js. Prior to 6.2.3, FTPContext.send throws when a command contains carriage return, line feed, or NUL characters, but calls made from response handlers execute synchronously inside the control socket's data event without an exception boundary. In Client.login, ...

CVE-2026-126345

basic-ftp is an FTP client for Node.js. Prior to 6.2.4, the MLSD directory-listing parser in src/parseListMLSD.ts uses untrusted fact names from the FTP server as keys in the plain-object factHandlersByName dictionary without checking that the resolved property is an own handler. A fact named pro...

GHSA-5PM8-86M8-9M6R basic-ftp: Uncaught TypeError in MLSD directory-listing parser via __proto__ fact name causes DoS in Client.list()

Summary basic-ftp's MLSD directory-listing parser src/parseListMLSD.ts looks up fact-handler functions in a plain object literal keyed directly by fact names taken from the FTP server's response, with no validation. A directory-listing line containing the fact name "proto" resolves this lookup to...

basic-ftp: Uncaught TypeError in MLSD directory-listing parser via __proto__ fact name causes DoS in Client.list()

Summary basic-ftp's MLSD directory-listing parser src/parseListMLSD.ts looks up fact-handler functions in a plain object literal keyed directly by fact names taken from the FTP server's response, with no validation. A directory-listing line containing the fact name "proto" resolves this lookup to...

npm: basic-ftp: Uncaught TypeError in MLSD directory-listing parser via __proto__ fact name causes DoS in Client.list()

npm: basic-ftp: Uncaught TypeError in MLSD directory-listing parser via proto fact name causes DoS in Client.list vulnerability discovered by ? in WordPress npm basic-ftp versions = 6.2.3...

EUVD-2026-124724

basic-ftp is an FTP client for Node.js. Prior to 6.2.3, FTPContext.send throws when a command contains carriage return, line feed, or NUL characters, but calls made from response handlers execute synchronously inside the control socket's data event without an exception boundary. In Client.login, ...

CVE-2026-126346 basic-ftp: Uncaught exception crashes the Node.js process when a password (or resumed-download path) contains CR/LF

basic-ftp is an FTP client for Node.js. Prior to 6.2.3, FTPContext.send throws when a command contains carriage return, line feed, or NUL characters, but calls made from response handlers execute synchronously inside the control socket's data event without an exception boundary. In Client.login, ...

CVE-2026-126346

basic-ftp is an FTP client for Node.js. Prior to 6.2.3, FTPContext.send throws when a command contains carriage return, line feed, or NUL characters, but calls made from response handlers execute synchronously inside the control socket's data event without an exception boundary. In Client.login, ...

CVE-2026-126346

The basic-ftp Node.js FTP client is vulnerable to a Denial of Service (DoS) via an uncaught exception in versions prior to 6.2.3 . The root cause is that FTPContext.send() throws an exception when encountering carriage return, line feed, or NUL characters in a command. Because response handlers e...

CVE-2026-126346 basic-ftp: Uncaught exception crashes the Node.js process when a password (or resumed-download path) contains CR/LF

basic-ftp is an FTP client for Node.js. Prior to 6.2.3, FTPContext.send throws when a command contains carriage return, line feed, or NUL characters, but calls made from response handlers execute synchronously inside the control socket's data event without an exception boundary. In Client.login, ...

CVE-2026-126345

basic-ftp is an FTP client for Node.js. Prior to 6.2.4, the MLSD directory-listing parser in src/parseListMLSD.ts uses untrusted fact names from the FTP server as keys in the plain-object factHandlersByName dictionary without checking that the resolved property is an own handler. A fact named pro...

CVE-2026-126345 basic-ftp: Uncaught TypeError in MLSD directory-listing parser via __proto__ fact name causes DoS in Client.list()

basic-ftp is an FTP client for Node.js. Prior to 6.2.4, the MLSD directory-listing parser in src/parseListMLSD.ts uses untrusted fact names from the FTP server as keys in the plain-object factHandlersByName dictionary without checking that the resolved property is an own handler. A fact named pro...

CVE-2026-126345

The basic-ftp Node.js FTP client is vulnerable to a Denial of Service (DoS) in its MLSD directory-listing parser (specifically in src/parseListMLSD.ts). Versions prior to 6.2.4 fail to verify that fact names received from an FTP server are own properties of the factHandlersByName dictionary. An a...

EUVD-2026-124723

basic-ftp is an FTP client for Node.js. Prior to 6.2.4, the MLSD directory-listing parser in src/parseListMLSD.ts uses untrusted fact names from the FTP server as keys in the plain-object factHandlersByName dictionary without checking that the resolved property is an own handler. A fact named pro...