Node.js FTP Client Vulnerability in basic-ftp by Patrick Juchli

CVE-2026-126346

What is CVE-2026-126346?

The basic-ftp FTP client for Node.js contains a vulnerability in versions prior to 6.2.3, where improper handling of commands could lead to exceptions that terminate the Node.js process. Specifically, when input containing carriage return, line feed, or NUL characters is processed, response handlers execute synchronously inside the control socket's data event without an exception boundary. An attacker could leverage this flaw to influence command sequences, allowing unauthorized access or functionality disruption. This issue was mitigated in version 6.2.3, emphasizing the importance of upgrading to the latest version.

References