basic-ftp vulnerabilities

basic-ftp before version 6.2.1 contains a ReDoS vulnerability in Client.list(). A malicious or compromised FTP server can force quadratic CPU time parsing a directory listing, blocking the Node.js event loop and freezing the process.

The vulnerability in basic-ftp prior to version 5.3.1 allows for client-side denial of service when parsing multiline FTP control responses. A malicious FTP server can send an unterminated response, leading to excessive memory and CPU usage.

The basic-ftp library for Node.js prior to version 5.2.1 is vulnerable to FTP command injection via CRLF sequences in file path parameters. An attacker can exploit this to execute arbitrary FTP commands on the server.