basic-ftp
6.2.3 · 9 Oct 2026MIT27.3M / weekRepositoryHomepagenpmAtom feed
Upgrading basic-ftp from 2.8.1 to 2.17.1
24 releases in betweennotes for 7
- ?
- changes to make
- 0
- advisories fixed
- ?
- new
- 1+
- fix
Counted from 7 of 24 release notes. Advisories are counted from the advisory database, in full.
Security
5 advisories still affect 2.17.1
- Basic FTP has Path Traversal Vulnerability in its downloadToDir() methodcritical · GHSA-5rq4-664w-9x2c
- basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commandshigh · GHSA-6v7q-wjvx-w8wg
- basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)high · GHSA-c475-qrg2-pj4r
Upgrading to 6.2.1 clears them.
Release by release
2.12.3 – 2.17.114 releases, nothing new or fixed; 12 without a note
- fixed
Fixed: Don't deny EPSV over IPv4. This can help in some circumstances with a NAT.
- fixed
2.8.2 – 2.12.19 releases, nothing new or fixed; 5 without a note
11 other lines we could not sort, mostly version bumps
- 2.14.2
Make it possible to reconnect after closing the client.
- 2.13.2
Various improvements to documentation.
- 2.9.2
Improved documentation of client methods.
- 2.9.2
Fixed: Reason for error when parsing PASV response was not reported.
- 2.9.0
Added: Report transfer progress with client.trackProgress().
- 2.9.0
Added: Error return codes can be ignored when removing a single file.
- 2.9.0
Fixed: Timeout behaviour of control and data socket.
- 2.8.3
Improve introduction.
- 2.8.2
When downloading, handle incoming data before announcement from control socket arrives.
- 2.8.2
More tests for uploading and downloading data including directory listings.
1 internal line (docs, tests, tooling) left out.