basic-ftp

6.2.3 · 9 Oct 2026MIT27.3M / weekRepository Homepage npm Atom feed

Your version

4.3.0

19 Oct 2019Where it was published

4.6.6 is the newest release of 4.x.

npm marks 4.3.0 as deprecated: Security vulnerability fixed in 5.2.1, please upgrade

In short

1 fixed2 changed

Security

5 advisories affect 4.3.0; 6.2.1 fixes them

Critical
Basic FTP has Path Traversal Vulnerability in its downloadToDir() methodGHSA-5rq4-664w-9x2c · 25 Feb 2026
Fixed in 5.2.0
High
basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)GHSA-c475-qrg2-pj4r · 1 Oct 2026
Fixed in 6.2.1
High
basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response bufferingGHSA-rpmf-866q-6p89 · 6 May 2026
Fixed in 5.3.1
High
basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()GHSA-rp42-5vxx-qpwr · 16 Apr 2026
Fixed in 5.3.0
High
basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD CommandsGHSA-6v7q-wjvx-w8wg · 10 Apr 2026
Fixed in 5.2.2

Release note

Added: More explicit API uploadFrom, appendFrom and downloadTo. upload and download are still available but deprecated.
Added: Handle file downloads and uploads directly by supporting local file paths in uploadFrom and downloadTo.
Added: Make it easier to resume a download of a partially downloaded file. See documentation of downloadTo for more details.