basic-ftp
6.2.3 · 9 Oct 2026MIT27.3M / weekRepositoryHomepagenpmAtom feed
Your version
2.17.1 is the newest release of 2.x.
npm marks 2.8.2 as deprecated: Security vulnerability fixed in 5.2.1, please upgrade
In short
3 changed
Security
5 advisories affect 2.8.2; 6.2.1 fixes them
- CriticalBasic FTP has Path Traversal Vulnerability in its downloadToDir() methodGHSA-5rq4-664w-9x2c · 25 Feb 2026Fixed in 5.2.0
- Highbasic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)GHSA-c475-qrg2-pj4r · 1 Oct 2026Fixed in 6.2.1
- Highbasic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response bufferingGHSA-rpmf-866q-6p89 · 6 May 2026Fixed in 5.3.1
- Highbasic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()GHSA-rp42-5vxx-qpwr · 16 Apr 2026Fixed in 5.3.0
- Highbasic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD CommandsGHSA-6v7q-wjvx-w8wg · 10 Apr 2026Fixed in 5.2.2
Release note
When downloading, handle incoming data before announcement from control socket arrives.
More tests for uploading and downloading data including directory listings.
Use download mechanism for directory listings as well.