basic-ftp
6.2.3 · 9 Oct 2026MIT27.3M / weekRepositoryHomepagenpmAtom feed
Upgrading basic-ftp from 3.1.1 to 3.8.7
22 releases in betweennotes for 19
Security
5 advisories still affect 3.8.7
- Basic FTP has Path Traversal Vulnerability in its downloadToDir() methodcritical · GHSA-5rq4-664w-9x2c
- basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commandshigh · GHSA-6v7q-wjvx-w8wg
- basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)high · GHSA-c475-qrg2-pj4r
Upgrading to 6.2.1 clears them.
Release by release
3.8.2 – 3.8.76 releases, nothing new or fixed; 3 without a note
- new
Fixed: Support non-standard response to EPSV by IBM i or z/OS servers.
- new
3.7.1 – 3.8.02 releases, nothing new or fixed in the notes
- fixed
Fixed: Handle stream error events for upload and download.
- fixed
3.4.4 – 3.6.03 releases, nothing new or fixed in the notes
- fixed
Fixed: Handle multline response message closing without message.
- fixed
3.3.1 – 3.4.24 releases, nothing new or fixed in the notes
- new
Added: Support for leading whitespace in file and directory names.
- new
19 other lines we could not sort, mostly version bumps
- 3.8.2
Fixed: Fall back to
LISTcommand ifLIST -ais not supported. - 3.8.1
Fixed: Improve marking protected methods for JS compilation output.
- 3.8.0
Added: Use
client.append()to append to an existing file on the FTP server. - 3.7.1
Fixed: Use ESLint instead of TSLint.
- 3.7.0
Added: Users can access internal transfer modes to force a specific one.
- 3.6.0
Added: Make parseList public API. (#75, @xnerhu)
- 3.6.0
Changed: Update Typescript 3.5.1
- 3.5.0
Added: Client
listmethod supports optional path argument. (#69, @ThatOdieGuy) - 3.5.0
Changed: Updated Typescript 3.4.4
- 3.4.4
Fixed: Reject failing connection for passive transfer with Error instance.
1 internal line (docs, tests, tooling) left out.