basic-ftp
6.2.3 · 9 Oct 2026MIT27.3M / weekRepositoryHomepagenpmAtom feed
Upgrading basic-ftp from 2.3.3 to 2.17.1
37 releases in betweennotes for 34
Security
5 advisories still affect 2.17.1
- Basic FTP has Path Traversal Vulnerability in its downloadToDir() methodcritical · GHSA-5rq4-664w-9x2c
- basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commandshigh · GHSA-6v7q-wjvx-w8wg
- basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)high · GHSA-c475-qrg2-pj4r
Upgrading to 6.2.1 clears them.
Release by release
2.12.3 – 2.17.114 releases, nothing new or fixed in the notes
- fixed
Fixed: Don't deny EPSV over IPv4. This can help in some circumstances with a NAT.
- fixed
- fixed
Fixed: Don't prefer IPv6 by default.
- fixed
- new
Added: Support IPv6 for passive mode (EPSV).
- new
- fixed
Stop using Yarn for internal dev-dependencies.
- fixed
- fixed
Resolve simple NAT issues with PASV.
- fixed
2.7.1 – 2.9.28 releases, nothing new or fixed; 1 without a note
- new
Add method to remove a file.
- fixed
Fix listing parser autodetection by filtering out empty lines.
- fixed
Fix upload with TLS, wait for secureConnect if necessary.
- new
46 other lines we could not sort, mostly version bumps
- 2.17.1
Fixed: Multibyte UTF-8 arriving in multiple chunks
- 2.17.1
Fixed: Provide stack trace when closing due to multiple tasks running
- 2.17.1
Internal improvements to linting
- 2.17.0
Added: Get last modification time of a file. (#32, @AnsonYeung)
- 2.16.1
Fixed: Closing client during task will reject associated promise.
- 2.16.0
Changed: Include hidden files in file listings, fixes
removeDirandclearWorkingDir. Changes behaviour fordownloadDirandlist. (#29, @conlanpatrek) - 2.15.0
Changed: Timeout on control socket is only considered during active task, not when idle. This also fixes #27, as well as #26.
- 2.14.4
Fixed: Regression where closed clients throws timeout because of idle socket.
- 2.14.3
Fixed: JSDoc type annotations.
- 2.14.3
Fixed: Minor fixes to documentation.
2 internal lines (docs, tests, tooling) left out.