Executive brief
basic-ftp is a Node.js library used by applications to transfer files and list directories on remote FTP servers. The library's directory listing function (Client.list()) buffers entire server responses in memory without imposing size limits, allowing a malicious or compromised FTP server to exhaust the client's available memory. An attacker can trigger process crashes or system instability by serving extremely large directory listings.
Technical details
The vulnerability is a memory exhaustion / denial-of-service issue in the StringWriter class used by Client.list(). The vulnerable code performs unbounded Buffer.concat() operations to accumulate chunks of the FTP server's response without any maximum size check. An attacker controlling or compromising the FTP server can send a large or infinite directory listing response to a client calling Client.list(), causing the client process to allocate memory without bound until it becomes unstable or is terminated. The attack requires the victim application to connect to an attacker-controlled FTP server and invoke the directory listing function. A fix is available in version 5.3.0, which implements maximum size enforcement and early termination of oversized transfers.
Affected products
- Patrick Juchli basic-ftp <=5.2.2
Timeline
- 2026-04-16: disclosed
- 2026-04-16: patched: Version 5.3.0 released with fix