basic-ftp (npm)
FTP client for Node.js, supports FTPS over TLS, passive mode over IPv6, async/await, and Typescript.
Advisories
12
Latest version
6.2.3
Released Oct 9, 2026
License
MIT
OpenSSF Scorecard
6.0 / 10
How to fix
Upgrading to 6.2.1 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install basic-ftp@6.2.3yarn
yarn add basic-ftp@6.2.3pnpm
pnpm add basic-ftp@6.2.3Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-c475-qrg2-pj4r basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking) |
High EPSS 0.37% |
< 6.2.1 | 6.2.1 |
| GHSA-c475-qrg2-pj4r basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking) |
High EPSS 0.37% |
<= 6.2.0 | No fix yet |
| GHSA-rpmf-866q-6p89 basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering |
High EPSS 0.51% |
<= 5.3.0 | No fix yet |
| GHSA-rpmf-866q-6p89 basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering |
High EPSS 0.51% |
< 5.3.1 | 5.3.1 |
| GHSA-rp42-5vxx-qpwr basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list() |
High EPSS 0.33% |
< 5.3.0 | 5.3.0 |
| GHSA-rp42-5vxx-qpwr basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list() |
High EPSS 0.33% |
<= 5.2.2 | No fix yet |
| GHSA-6v7q-wjvx-w8wg basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands |
High | < 5.2.2 | 5.2.2 |
| GHSA-6v7q-wjvx-w8wg basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands |
High | <= 5.2.1 | No fix yet |
| GHSA-chqc-8p9q-pq6q basic-ftp has FTP Command Injection via CRLF |
High EPSS 2.19% |
No fix yet | |
| GHSA-chqc-8p9q-pq6q basic-ftp has FTP Command Injection via CRLF |
High EPSS 2.19% |
>= 5.2.0, < 5.2.1 | 5.2.1 |
| GHSA-5rq4-664w-9x2c Basic FTP has Path Traversal Vulnerability in its downloadToDir() method |
Critical EPSS 0.94% |
< 5.2.0 | 5.2.0 |
| GHSA-5rq4-664w-9x2c Basic FTP has Path Traversal Vulnerability in its downloadToDir() method |
Critical EPSS 0.94% |
< 5.2.0 | 5.2.0 |
Source: git+https://github.com/patrickjuchli/basic-ftp.git
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor