To report a vulnerability open a draft at https://github.com/patrickjuchli/basic-ftp/security/advisories. Thanks!
Repository navigation
Security: patrickjuchli/basic-ftp
Security
SECURITY.md
-
ProtoDrop — Uncaught TypeError in MLSD directory-listing parser via __proto__ fact name causes DoS in Client.list() (basic-ftp)GHSA-5pm8-86m8-9m6r published
Oct 30, 2026 by patrickjuchliModerate -
Uncaught exception crashes the Node.js process when a password (or resumed-download path) contains CR/LFGHSA-r4jh-29pc-gfqr published
Oct 30, 2026 by patrickjuchliModerate -
Two remaining quadratic (ReDoS) parsing paths in basic-ftp 6.2.1 — MLSD detection + PASV parserGHSA-5rfr-xx34-2xxv published
Oct 4, 2026 by patrickjuchliModerate -
Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)GHSA-c475-qrg2-pj4r published
Aug 27, 2026 by patrickjuchliHigh -
basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response bufferingGHSA-rpmf-866q-6p89 published
Apr 28, 2026 by patrickjuchliHigh -
basic-ftp@5.2.2 vulnerable to denial of service via unbounded memory consumption in Client.list()GHSA-rp42-5vxx-qpwr published
Apr 15, 2026 by patrickjuchliHigh -
Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD CommandsGHSA-6v7q-wjvx-w8wg published
Apr 9, 2026 by patrickjuchliHigh -
FTP Command Injection via CRLF in basic-ftpGHSA-chqc-8p9q-pq6q published
Apr 8, 2026 by patrickjuchliHigh -
Path Traversal Vulnerability in basic-ftpGHSA-5rq4-664w-9x2c published
Feb 23, 2026 by patrickjuchliCritical
Learn more about advisories related to patrickjuchli/basic-ftp in the GitHub Advisory Database