basic-ftp
6.2.3 · 9 Oct 2026MIT27.3M / weekRepositoryHomepagenpmAtom feed
Upgrading basic-ftp from 4.6.6 to 6.2.3
20 releases in betweennotes for 13
- 1+
- change to make
- 5
- advisories fixed
- ?
- new
- ?
- fixes
Counted from 13 of 20 release notes. Advisories are counted from the advisory database, in full.
Before you upgrade
Tick each one off as you go- breaking6.0.0
Security
Fixes 5 advisories affecting 4.6.6
- Basic FTP has Path Traversal Vulnerability in its downloadToDir() methodcritical · GHSA-5rq4-664w-9x2c
- basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commandshigh · GHSA-6v7q-wjvx-w8wg
- basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)high · GHSA-c475-qrg2-pj4r
- basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()high · GHSA-rp42-5vxx-qpwr
- basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response bufferinghigh · GHSA-rpmf-866q-6p89
- 6.2.3
Fixed: A password or a path of a resumed download containing control characters could throw an uncaught exception and terminate the process, fixes github.com/patrickjuchli/basic-ftp/security/adv….
- 6.2.2
Fixed: Protect against excessive CPU use when detecting an MLSD directory listing or parsing a PASV response, fixes github.com/patrickjuchli/basic-ftp/security/adv….
- 6.2.1
Fixed: Protect against excessive CPU use when parsing a directory listing, fixes github.com/patrickjuchli/basic-ftp/security/adv….
- 6.0.2
Fixed: Implicit FTPS transfers against servers requiring TLS session reuse failed with "425 ... TLS session of data connection not resumed" on Node.js with the CVE-2026-48934 fix (22.23.0+, 24.17.0+, 26.3.1+).
- 5.3.0
Changed: Introduced an upper bound for total bytes of directory listing, fixes github.com/patrickjuchli/basic-ftp/security/adv….
- 5.2.2
Fixed: Improve control character rejection, fixes github.com/patrickjuchli/basic-ftp/security/adv….
- 5.2.1
Fixed: Reject control character injection attempts using paths. See github.com/patrickjuchli/basic-ftp/security/adv….
11 other lines we could not sort, mostly version bumps
- 6.2.3
Fixed: A command rejected for containing control characters left the client unusable.
- 6.2.3
Fixed: The error for a rejected
PASScommand included the password. - 6.2.1
Fixed: A transfer could time out right after a slow local source or destination stopped holding it up, before the server had a chance to continue.
- 6.2.0
Changed: Timeout tracking during data transfers now only applies to the server, not a slow local source or destination.
- 6.2.0
Fixed: A failed transfer could report its failure twice and cancel an unrelated command issued afterwards, leaving it without a response.
- 6.1.0
Changed: Uploading from a local path now throws if the file changes while it's being read, instead of reporting the incomplete upload as successful.
- 6.0.1
Fixed: Use and renew TLS 1.3 session tickets for data connections. (Thanks for testing, @dennisameling)
- 5.3.0
Added: Option to increase the upper bound for total bytes of directory listing in Client constructor.
- 5.2.0
Changed: Skip files with invalid name in downloadToDir.
- 5.0.2
Fixed: Use existing code path to close control socket when replacing it.