basic-ftp
6.2.3 · 9 Oct 2026MIT27.3M / weekRepositoryHomepagenpmAtom feed
6.2.3 is the newest release of 6.x.
In short
1 breaking
- breaking
This library does not allow separate transfer hosts by default anymore. This provides security by default against FTP bounce attacks. This FTP feature is used very rarely, there is a good chance you don't actually have to change anything in your code. You can allow separate transfer hosts by using
allowSeparateTransferHost: truewhen instantiating aClient. (Thanks, @Jvr2022)
Security
1 advisory affects 6.0.0; 6.2.1 fixes them
- Highbasic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)GHSA-c475-qrg2-pj4r · 1 Oct 2026Fixed in 6.2.1
Release note
- breaking
This library does not allow separate transfer hosts by default anymore. This provides security by default against FTP bounce attacks. This FTP feature is used very rarely, there is a good chance you don't actually have to change anything in your code. You can allow separate transfer hosts by using
allowSeparateTransferHost: truewhen instantiating aClient. (Thanks, @Jvr2022)