basic-ftp
6.2.3 · 9 Oct 2026MIT27.3M / weekRepositoryHomepagenpmAtom feed
Upgrading basic-ftp from 2.4.2 to 6.2.3
102 releases in betweennotes for 96
Counted from 96 of 102 release notes. Advisories are counted from the advisory database, in full.
Before you upgrade
Tick each one off as you go- breaking6.0.0
- breaking5.0.0
- deprecated4.4.0
- deprecated4.0.0
Security
Fixes 5 advisories affecting 2.4.2
- Basic FTP has Path Traversal Vulnerability in its downloadToDir() methodcritical · GHSA-5rq4-664w-9x2c
- basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commandshigh · GHSA-6v7q-wjvx-w8wg
- basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)high · GHSA-c475-qrg2-pj4r
- basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()high · GHSA-rp42-5vxx-qpwr
- basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response bufferinghigh · GHSA-rpmf-866q-6p89
- 6.2.3
Fixed: A password or a path of a resumed download containing control characters could throw an uncaught exception and terminate the process, fixes github.com/patrickjuchli/basic-ftp/security/adv….
- 6.2.2
Fixed: Protect against excessive CPU use when detecting an MLSD directory listing or parsing a PASV response, fixes github.com/patrickjuchli/basic-ftp/security/adv….
- 6.2.1
Fixed: Protect against excessive CPU use when parsing a directory listing, fixes github.com/patrickjuchli/basic-ftp/security/adv….
- 6.0.2
Fixed: Implicit FTPS transfers against servers requiring TLS session reuse failed with "425 ... TLS session of data connection not resumed" on Node.js with the CVE-2026-48934 fix (22.23.0+, 24.17.0+, 26.3.1+).
- 5.3.1
Fixed: Protect against unbounded control response, fixes github.com/patrickjuchli/basic-ftp/security/adv….
- 5.3.0
Changed: Introduced an upper bound for total bytes of directory listing, fixes github.com/patrickjuchli/basic-ftp/security/adv….
- 5.2.2
Fixed: Improve control character rejection, fixes github.com/patrickjuchli/basic-ftp/security/adv….
- 5.2.1
Fixed: Reject control character injection attempts using paths. See github.com/patrickjuchli/basic-ftp/security/adv….
Release by release
5.2.0 – 6.2.313 releases, nothing new or fixed in the notes
- new
Added: Add the option to prevent the use of separate transfer host IPs when using PASV.
- new
5.0.5nothing new or fixed in the note
- fixed
Fixed: Handle relative paths in Client.removeDir()
- fixed
- fixed
Fixed: Avoid deprecation error.
- fixed
5.0.2nothing new or fixed in the note
- fixed
Fixed: Don't trust FEAT response of servers regarding EPSV.
- fixed
- fixed
Fixed: Prevent late internal exceptions from sockets.
- fixed
Fixed: Stop explicitly destroying sockets, too early in rare cases.
- fixed
114 other lines we could not sort, mostly version bumps
- 6.2.3
Fixed: A command rejected for containing control characters left the client unusable.
- 6.2.3
Fixed: The error for a rejected
PASScommand included the password. - 6.2.1
Fixed: A transfer could time out right after a slow local source or destination stopped holding it up, before the server had a chance to continue.
- 6.2.0
Changed: Timeout tracking during data transfers now only applies to the server, not a slow local source or destination.
- 6.2.0
Fixed: A failed transfer could report its failure twice and cancel an unrelated command issued afterwards, leaving it without a response.
- 6.1.0
Changed: Uploading from a local path now throws if the file changes while it's being read, instead of reporting the incomplete upload as successful.
- 6.0.1
Fixed: Use and renew TLS 1.3 session tickets for data connections. (Thanks for testing, @dennisameling)
- 5.3.0
Added: Option to increase the upper bound for total bytes of directory listing in Client constructor.
- 5.2.0
Changed: Skip files with invalid name in downloadToDir.
- 5.0.5
Fixed: Memory leak described
3 internal lines (docs, tests, tooling) left out.