basic-ftp
6.2.3 · 9 Oct 2026MIT27.3M / weekRepositoryHomepagenpmAtom feed
Upgrading basic-ftp from 4.1.0 to 4.6.6
19 releases in betweennotes for 7
- 1+
- change to make
- 0
- advisories fixed
- 2+
- new
- 4+
- fixes
Counted from 7 of 19 release notes. Advisories are counted from the advisory database, in full.
Before you upgrade
Tick each one off as you go- deprecated4.4.0
Security
5 advisories still affect 4.6.6
- Basic FTP has Path Traversal Vulnerability in its downloadToDir() methodcritical · GHSA-5rq4-664w-9x2c
- basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commandshigh · GHSA-6v7q-wjvx-w8wg
- basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)high · GHSA-c475-qrg2-pj4r
Upgrading to 6.2.1 clears them.
Release by release
4.6.3 – 4.6.64 releases, no release note
- new
Fixed: Allow directory names ending with space in client.list(). (#149, @inithink)
- fixed
Fixed: Don't trim incoming message chunks.
- new
4.4.0 – 4.6.19 releases, nothing new or fixed; 7 without a note
- fixed
Fixed regression at 4.3.0: File descriptor closed too early.
- fixed
4.3.1no release note
- fixed
Added: Handle file downloads and uploads directly by supporting local file paths in
uploadFromanddownloadTo.
- fixed
- fixed
Fixed: Don't rely on MLSD types 'cdir' and 'pdir', consider names as well.
- fixed
- new
Added: Support uploading a local directory to any specific remote directory instead of just the working directory.
- new
5 other lines we could not sort, mostly version bumps
- 4.6.2
Fixed: Reference Node.js types in tsconfig settings.
- 4.5.2
Fixed: Try next available list command after any FTP error.
- 4.4.0
Added: You can specifiy a custom remote directory with
downloadToDir. - 4.3.0
Added: More explicit API
uploadFrom,appendFromanddownloadTo.uploadanddownloadare still available but deprecated. - 4.3.0
Added: Make it easier to resume a download of a partially downloaded file. See documentation of
downloadTofor more details.