basic-ftp

6.2.3 · 9 Oct 2026MIT27.3M / weekRepository Homepage npm Atom feed

Same major only

9 releases in betweennotes for 8

Counted from 8 of 9 release notes. Advisories are counted from the advisory database, in full.

Before you upgrade

Tick each one off as you go

This library does not allow separate transfer hosts by default anymore. This provides security by default against FTP bounce attacks. This FTP feature is used very rarely, there is a good chance you don't actually have to change anything in your code. You can allow separate transfer hosts by using allowSeparateTransferHost: true when instantiating a Client. (Thanks, @Jvr2022)
breaking6.0.0

Fixes 2 advisories affecting 5.3.0

Fixed: A password or a path of a resumed download containing control characters could throw an uncaught exception and terminate the process, fixes github.com/patrickjuchli/basic-ftp/security/adv….
6.2.3
Fixed: Protect against excessive CPU use when detecting an MLSD directory listing or parsing a PASV response, fixes github.com/patrickjuchli/basic-ftp/security/adv….
6.2.2
Fixed: Protect against excessive CPU use when parsing a directory listing, fixes github.com/patrickjuchli/basic-ftp/security/adv….
6.2.1
Fixed: Implicit FTPS transfers against servers requiring TLS session reuse failed with "425 ... TLS session of data connection not resumed" on Node.js with the CVE-2026-48934 fix (22.23.0+, 24.17.0+, 26.3.1+).
6.0.2

7 other lines we could not sort, mostly version bumps

Fixed: A command rejected for containing control characters left the client unusable.
6.2.3
Fixed: The error for a rejected PASS command included the password.
6.2.3
Fixed: A transfer could time out right after a slow local source or destination stopped holding it up, before the server had a chance to continue.
6.2.1
Changed: Timeout tracking during data transfers now only applies to the server, not a slow local source or destination.
6.2.0
Fixed: A failed transfer could report its failure twice and cancel an unrelated command issued afterwards, leaving it without a response.
6.2.0
Changed: Uploading from a local path now throws if the file changes while it's being read, instead of reporting the incomplete upload as successful.
6.1.0
Fixed: Use and renew TLS 1.3 session tickets for data connections. (Thanks for testing, @dennisameling)
6.0.1

npm install basic-ftp@6.2.3

Reading 6.2.3's manifest…

Check against your package.json

Which of your other dependencies stand in the way of 6.2.3. Read once, not stored.