# CVE-2026-126346: basic-ftp unhandled exception in control socket event handler

Source: https://junglewise.ai/threats/cve-2026-126346-basic-ftp-uncaught-exception-crashes-the-node-js-process-when-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-126346 · Severity: medium · CVSS 5.9 · Published 2026-11-12

basic-ftp is an FTP client library for Node.js applications. When an FTP server sends certain responses, a password or file path containing control characters (carriage return, line feed, NUL) can trigger an unhandled exception in the socket event handler, crashing the entire Node.js process. This allows attackers who control an FTP server to remotely crash applications using the library.

Technologies: [basic-ftp (npm)](https://junglewise.ai/threats/technologies/basic-ftp). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-126346 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126346 being exploited in the wild.

**How severe is CVE-2026-126346?** Medium severity, with a CVSS score of 5.9, published 12 November 2026.

**Which products and versions are affected?** Basic-Ftp 6.2.2 and likely earlier, before 6.2.3; basic-ftp (npm) <= 6.2.2, SEMVER:introduced=0,fixed=6.2.3.

**Is there a fix for CVE-2026-126346?** Yes. basic-ftp (npm): upgrade to 6.2.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126346 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-126346?** Check whether you run Basic-Ftp or basic-ftp (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- basic-ftp (npm): upgrade to 6.2.3 or later

  ```sh
  npm install basic-ftp@6.2.3
  ```


## Technical details

FTPContext.send() throws exceptions for commands containing carriage return, line feed, or NUL characters, but calls made from response handlers in the control socket's data event execute without exception boundaries. In Client.login(), attacker-influenced passwords reach the PASS command after a 331 server response, and in resumed downloads, attacker-influenced remote paths reach the RETR command after a 350 response to REST. The resulting uncaught exception terminates the Node.js process while the command injection guard still prevents actual injection attacks.

## Affected products

- basic-ftp basic-ftp before 6.2.3

## Identifiers

- CVE-2026-126346
- GHSA-r4jh-29pc-gfqr

## Timeline

- 2026-11-12: disclosed

## References

- [https://github.com/patrickjuchli/basic-ftp/commit/0495b906bdf891e68806721b07b333dba65ec88e](https://github.com/patrickjuchli/basic-ftp/commit/0495b906bdf891e68806721b07b333dba65ec88e)
- [https://github.com/patrickjuchli/basic-ftp/releases/tag/v6.2.3](https://github.com/patrickjuchli/basic-ftp/releases/tag/v6.2.3)

## Related threats

- [basic-ftp MLSD parser prototype pollution](https://junglewise.ai/threats/cve-2026-126345-basic-ftp-uncaught-typeerror-in-mlsd-directory-listing-parser)
- [basic-ftp quadratic-time denial of service in Client.list()](https://junglewise.ai/threats/cve-2026-102990-basic-ftp-is-an-ftp-client-for-node-js-prior-to-6-2-1-client)
- [basic-ftp denial of service via unbounded multiline response buffering](https://junglewise.ai/threats/cve-2026-44240-basic-ftp-denial-of-service-via-unbounded-multiline-control)
- [basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()](https://junglewise.ai/threats/cve-2026-41324-basic-ftp-vulnerable-to-denial-of-service-via-unbounded-memory)
- [basic-ftp CRLF injection via incomplete validation](https://junglewise.ai/threats/basic-ftp-crlf-injection-via-incomplete-validation-c2967386)