CVE-2026-44240
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
The vulnerability in basic-ftp prior to version 5.3.1 allows for client-side denial of service when parsing multiline FTP control responses. A malicious FTP server can send an unterminated response, leading to excessive memory and CPU usage.
Risk Assessment
Organizations may experience application lockups using basic-ftp, resulting in service availability issues and increased resource consumption.
Recommendation
It is recommended to upgrade to version 5.3.1 or later to mitigate this vulnerability and reduce the risk of denial of service attacks.
Other vulnerabilities in basic-ftp
See all- CVE-2026-102990High
basic-ftp before version 6.2.1 contains a ReDoS vulnerability in Client.list(). A malicious or compromised FTP server can force quadratic CPU time parsing a directory listing, blocking the Node.js event loop and freezing the process.
- CVE-2026-39983High
The basic-ftp library for Node.js prior to version 5.2.1 is vulnerable to FTP command injection via CRLF sequences in file path parameters. An attacker can exploit this to execute arbitrary FTP commands on the server.
Original NVD description (English source)
basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is vulnerable to client-side denial of service when parsing FTP control-channel multiline responses. A malicious or compromised FTP server can send an unterminated multiline response during the initial FTP banner phase, before authentication. The client keeps appending attacker-controlled data into FtpContext._partialResponse and repeatedly reparses the accumulated buffer without enforcing a maximum control response size. As a result, an application using basic-ftp can remain stuck in connect() while memory and CPU usage grow under attacker-controlled input. This can lead to process-level denial of service, container OOM kills, worker restarts, queue backlog, or service degradation in applications that automatically connect to FTP endpoints. This vulnerability is fixed in 5.3.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS