basic-ftp
6.2.3 · 9 Oct 2026MIT27.3M / weekRepositoryHomepagenpmAtom feed
Upgrading basic-ftp from 2.10.0 to 6.2.1
84 releases in betweennotes for 34
Counted from 34 of 84 release notes. Advisories are counted from the advisory database, in full.
Before you upgrade
Tick each one off as you go- breaking6.0.0
- deprecated4.4.0
Security
Fixes 5 advisories affecting 2.10.0
- Basic FTP has Path Traversal Vulnerability in its downloadToDir() methodcritical · GHSA-5rq4-664w-9x2c
- basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commandshigh · GHSA-6v7q-wjvx-w8wg
- basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)high · GHSA-c475-qrg2-pj4r
- basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()high · GHSA-rp42-5vxx-qpwr
- basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response bufferinghigh · GHSA-rpmf-866q-6p89
- 6.2.1
Fixed: Protect against excessive CPU use when parsing a directory listing, fixes github.com/patrickjuchli/basic-ftp/security/adv….
- 6.0.2
Fixed: Implicit FTPS transfers against servers requiring TLS session reuse failed with "425 ... TLS session of data connection not resumed" on Node.js with the CVE-2026-48934 fix (22.23.0+, 24.17.0+, 26.3.1+).
- 5.3.0
Changed: Introduced an upper bound for total bytes of directory listing, fixes github.com/patrickjuchli/basic-ftp/security/adv….
- 5.2.2
Fixed: Improve control character rejection, fixes github.com/patrickjuchli/basic-ftp/security/adv….
- 5.2.1
Fixed: Reject control character injection attempts using paths. See github.com/patrickjuchli/basic-ftp/security/adv….
Release by release
4.6.3 – 6.2.122 releases, nothing new or fixed; 11 without a note
- new
Fixed: Allow directory names ending with space in client.list(). (#149, @inithink)
- fixed
Fixed: Don't trim incoming message chunks.
- new
4.4.0 – 4.6.19 releases, nothing new or fixed; 7 without a note
- fixed
Fixed regression at 4.3.0: File descriptor closed too early.
- fixed
4.3.1no release note
- fixed
Added: Handle file downloads and uploads directly by supporting local file paths in
uploadFromanddownloadTo.
- fixed
- fixed
Fixed: Don't rely on MLSD types 'cdir' and 'pdir', consider names as well.
- fixed
- new
Added: Support uploading a local directory to any specific remote directory instead of just the working directory.
- new
28 other lines we could not sort, mostly version bumps
- 6.2.1
Fixed: A transfer could time out right after a slow local source or destination stopped holding it up, before the server had a chance to continue.
- 6.2.0
Changed: Timeout tracking during data transfers now only applies to the server, not a slow local source or destination.
- 6.2.0
Fixed: A failed transfer could report its failure twice and cancel an unrelated command issued afterwards, leaving it without a response.
- 6.1.0
Changed: Uploading from a local path now throws if the file changes while it's being read, instead of reporting the incomplete upload as successful.
- 6.0.1
Fixed: Use and renew TLS 1.3 session tickets for data connections. (Thanks for testing, @dennisameling)
- 5.3.0
Added: Option to increase the upper bound for total bytes of directory listing in Client constructor.
- 5.2.0
Changed: Skip files with invalid name in downloadToDir.
- 5.0.2
Fixed: Use existing code path to close control socket when replacing it.
- 5.0.2
Fixed: Destroy sockets explicitly on timeouts only.
- 4.6.2
Fixed: Reference Node.js types in tsconfig settings.