BA
Product
basic-ftp
5
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 1High 4Medium 0Low 0
Watch
Add basic-ftp to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-27699 | 9.8 | Feb 25 | The `basic-ftp` FTP client library for Node.js contains a path traversal vulnerability (CWE-22) in versions prior to 5.2.0 in the `downloadToDir()` method Affected: before 5.2.0 |
| CVE-2026-39983 | 8.6 | Apr 9 | FTP Command Injection via CRLF in basic-ftp Affected: < 5.2.1 |
| CVE-2026-102990 | 8.2 | Sep 30 | basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking) Affected: < 6.2.1 |
| CVE-2026-44240 | 7.5 | May 12 | basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering Affected: < 5.3.1 |
| CVE-2026-41324 | 7.5 | Apr 24 | basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list() Affected: < 5.3.0 |
Showing 5