basic-ftp
6.2.3 · 9 Oct 2026MIT27.3M / weekRepositoryHomepagenpmAtom feed
Upgrading basic-ftp from 3.3.1 to 6.2.1
58 releases in betweennotes for 55
Counted from 55 of 58 release notes. Advisories are counted from the advisory database, in full.
Before you upgrade
Tick each one off as you go- breaking6.0.0
- breaking5.0.0
- deprecated4.4.0
- deprecated4.0.0
Security
Fixes 5 advisories affecting 3.3.1
- Basic FTP has Path Traversal Vulnerability in its downloadToDir() methodcritical · GHSA-5rq4-664w-9x2c
- basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commandshigh · GHSA-6v7q-wjvx-w8wg
- basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)high · GHSA-c475-qrg2-pj4r
- basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()high · GHSA-rp42-5vxx-qpwr
- basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response bufferinghigh · GHSA-rpmf-866q-6p89
- 6.2.1
Fixed: Protect against excessive CPU use when parsing a directory listing, fixes github.com/patrickjuchli/basic-ftp/security/adv….
- 6.0.2
Fixed: Implicit FTPS transfers against servers requiring TLS session reuse failed with "425 ... TLS session of data connection not resumed" on Node.js with the CVE-2026-48934 fix (22.23.0+, 24.17.0+, 26.3.1+).
- 5.3.1
Fixed: Protect against unbounded control response, fixes github.com/patrickjuchli/basic-ftp/security/adv….
- 5.3.0
Changed: Introduced an upper bound for total bytes of directory listing, fixes github.com/patrickjuchli/basic-ftp/security/adv….
- 5.2.2
Fixed: Improve control character rejection, fixes github.com/patrickjuchli/basic-ftp/security/adv….
- 5.2.1
Fixed: Reject control character injection attempts using paths. See github.com/patrickjuchli/basic-ftp/security/adv….
Release by release
5.2.0 – 6.2.111 releases, nothing new or fixed in the notes
- new
Added: Add the option to prevent the use of separate transfer host IPs when using PASV.
- new
5.0.5nothing new or fixed in the note
- fixed
Fixed: Handle relative paths in Client.removeDir()
- fixed
- fixed
Fixed: Avoid deprecation error.
- fixed
5.0.2nothing new or fixed in the note
- fixed
Fixed: Don't trust FEAT response of servers regarding EPSV.
- fixed
- fixed
Fixed: Prevent late internal exceptions from sockets.
- fixed
Fixed: Stop explicitly destroying sockets, too early in rare cases.
- fixed
57 other lines we could not sort, mostly version bumps
- 6.2.1
Fixed: A transfer could time out right after a slow local source or destination stopped holding it up, before the server had a chance to continue.
- 6.2.0
Changed: Timeout tracking during data transfers now only applies to the server, not a slow local source or destination.
- 6.2.0
Fixed: A failed transfer could report its failure twice and cancel an unrelated command issued afterwards, leaving it without a response.
- 6.1.0
Changed: Uploading from a local path now throws if the file changes while it's being read, instead of reporting the incomplete upload as successful.
- 6.0.1
Fixed: Use and renew TLS 1.3 session tickets for data connections. (Thanks for testing, @dennisameling)
- 5.3.0
Added: Option to increase the upper bound for total bytes of directory listing in Client constructor.
- 5.2.0
Changed: Skip files with invalid name in downloadToDir.
- 5.0.5
Fixed: Memory leak described
- 5.0.3
Fixed: Improve closing sequence for control socket. (#224, #228)
- 5.0.3
Fixed: Set default settings before login in case there are non-ascii characters in user or password. (#229, @lgpseu)
1 internal line (docs, tests, tooling) left out.