basic-ftp
6.2.3 · 9 Oct 2026MIT27.3M / weekRepositoryHomepagenpmAtom feed
Your version
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
| Line | Newest | Where it stands |
|---|---|---|
| 6.2.3 | Safe from 6.2.1 | |
| 5.3.1 | 1 open advisory, worst high | |
| 4.6.6 | 20 open advisories, worst critical · last release Mar 2021, no longer updated |
- CriticalBasic FTP has Path Traversal Vulnerability in its downloadToDir() methodGHSA-5rq4-664w-9x2c · 25 Feb 2026fixed in 5.2.0
- Highbasic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)GHSA-c475-qrg2-pj4r · 1 Oct 2026fixed in 6.2.1
- Highbasic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response bufferingGHSA-rpmf-866q-6p89 · 6 May 2026fixed in 5.3.1
- Highbasic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()GHSA-rp42-5vxx-qpwr · 16 Apr 2026fixed in 5.3.0
- Highbasic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD CommandsGHSA-6v7q-wjvx-w8wg · 10 Apr 2026fixed in 5.2.2
- Highbasic-ftp has FTP Command Injection via CRLFGHSA-chqc-8p9q-pq6q · 8 Apr 2026fixed in 5.2.1
Registry facts last checked 29 Oct 2026. Releases and advisories last read 29 Oct 2026.