basic-ftp
6.2.3 · 9 Oct 2026MIT27.3M / weekRepositoryHomepagenpmAtom feed
Upgrading basic-ftp from 4.5.2 to 6.2.3
29 releases in betweennotes for 14
Counted from 14 of 29 release notes. Advisories are counted from the advisory database, in full.
Before you upgrade
Tick each one off as you go- breaking6.0.0
Security
Fixes 5 advisories affecting 4.5.2
- Basic FTP has Path Traversal Vulnerability in its downloadToDir() methodcritical · GHSA-5rq4-664w-9x2c
- basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commandshigh · GHSA-6v7q-wjvx-w8wg
- basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)high · GHSA-c475-qrg2-pj4r
- basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()high · GHSA-rp42-5vxx-qpwr
- basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response bufferinghigh · GHSA-rpmf-866q-6p89
- 6.2.3
Fixed: A password or a path of a resumed download containing control characters could throw an uncaught exception and terminate the process, fixes github.com/patrickjuchli/basic-ftp/security/adv….
- 6.2.2
Fixed: Protect against excessive CPU use when detecting an MLSD directory listing or parsing a PASV response, fixes github.com/patrickjuchli/basic-ftp/security/adv….
- 6.2.1
Fixed: Protect against excessive CPU use when parsing a directory listing, fixes github.com/patrickjuchli/basic-ftp/security/adv….
- 6.0.2
Fixed: Implicit FTPS transfers against servers requiring TLS session reuse failed with "425 ... TLS session of data connection not resumed" on Node.js with the CVE-2026-48934 fix (22.23.0+, 24.17.0+, 26.3.1+).
- 5.3.0
Changed: Introduced an upper bound for total bytes of directory listing, fixes github.com/patrickjuchli/basic-ftp/security/adv….
- 5.2.2
Fixed: Improve control character rejection, fixes github.com/patrickjuchli/basic-ftp/security/adv….
- 5.2.1
Fixed: Reject control character injection attempts using paths. See github.com/patrickjuchli/basic-ftp/security/adv….
Release by release
4.6.3 – 6.2.324 releases, nothing new or fixed; 11 without a note
- new
Fixed: Allow directory names ending with space in client.list(). (#149, @inithink)
- fixed
Fixed: Don't trim incoming message chunks.
- new
4.5.3 – 4.6.14 releases, no release note
12 other lines we could not sort, mostly version bumps
- 6.2.3
Fixed: A command rejected for containing control characters left the client unusable.
- 6.2.3
Fixed: The error for a rejected
PASScommand included the password. - 6.2.1
Fixed: A transfer could time out right after a slow local source or destination stopped holding it up, before the server had a chance to continue.
- 6.2.0
Changed: Timeout tracking during data transfers now only applies to the server, not a slow local source or destination.
- 6.2.0
Fixed: A failed transfer could report its failure twice and cancel an unrelated command issued afterwards, leaving it without a response.
- 6.1.0
Changed: Uploading from a local path now throws if the file changes while it's being read, instead of reporting the incomplete upload as successful.
- 6.0.1
Fixed: Use and renew TLS 1.3 session tickets for data connections. (Thanks for testing, @dennisameling)
- 5.3.0
Added: Option to increase the upper bound for total bytes of directory listing in Client constructor.
- 5.2.0
Changed: Skip files with invalid name in downloadToDir.
- 5.0.2
Fixed: Use existing code path to close control socket when replacing it.