basic-ftp
6.2.3 · 9 Oct 2026MIT27.3M / weekRepositoryHomepagenpmAtom feed
Upgrading basic-ftp from 6.0.0 to 6.2.3
7 releases in betweenevery note read
- 0
- changes to make
- 1
- advisory fixed
- 0
- new
- 0
- fixes
Security
Fixes 1 advisory affecting 6.0.0
- 6.2.3
Fixed: A password or a path of a resumed download containing control characters could throw an uncaught exception and terminate the process, fixes github.com/patrickjuchli/basic-ftp/security/adv….
- 6.2.2
Fixed: Protect against excessive CPU use when detecting an MLSD directory listing or parsing a PASV response, fixes github.com/patrickjuchli/basic-ftp/security/adv….
- 6.2.1
Fixed: Protect against excessive CPU use when parsing a directory listing, fixes github.com/patrickjuchli/basic-ftp/security/adv….
- 6.0.2
Fixed: Implicit FTPS transfers against servers requiring TLS session reuse failed with "425 ... TLS session of data connection not resumed" on Node.js with the CVE-2026-48934 fix (22.23.0+, 24.17.0+, 26.3.1+).
7 other lines we could not sort, mostly version bumps
- 6.2.3
Fixed: A command rejected for containing control characters left the client unusable.
- 6.2.3
Fixed: The error for a rejected
PASScommand included the password. - 6.2.1
Fixed: A transfer could time out right after a slow local source or destination stopped holding it up, before the server had a chance to continue.
- 6.2.0
Changed: Timeout tracking during data transfers now only applies to the server, not a slow local source or destination.
- 6.2.0
Fixed: A failed transfer could report its failure twice and cancel an unrelated command issued afterwards, leaving it without a response.
- 6.1.0
Changed: Uploading from a local path now throws if the file changes while it's being read, instead of reporting the incomplete upload as successful.
- 6.0.1
Fixed: Use and renew TLS 1.3 session tickets for data connections. (Thanks for testing, @dennisameling)