CVE-2026-41324: basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()

CVE-2026-41324 · Severity: high · CVSS 7.5 · Published 2026-04-24

basic-ftp is a Node.js library used by applications to transfer files and list directories on remote FTP servers. The library's directory listing function (Client.list()) buffers entire server responses in memory without imposing size limits, allowing a malicious or compromised FTP server to exhaust the client's available memory. An attacker can trigger process crashes or system instability by serving extremely large directory listings.

Technologies: basic-ftp (npm). Vendors: npm.

Quick answers

Is CVE-2026-41324 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41324 being exploited in the wild.
How severe is CVE-2026-41324?
High severity, with a CVSS score of 7.5, published 24 April 2026.
Which products and versions are affected?
basic-ftp (npm) <= 5.2.2, SEMVER:introduced=0,fixed=5.3.0.
Is there a fix for CVE-2026-41324?
Yes. basic-ftp (npm): upgrade to 5.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41324 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41324?
Check whether you run basic-ftp (npm) or Patrickjuchli Basic-Ftp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • basic-ftp (npm): upgrade to 5.3.0 or later
    npm install basic-ftp@5.3.0

Technical details

The vulnerability is a memory exhaustion / denial-of-service issue in the StringWriter class used by Client.list(). The vulnerable code performs unbounded Buffer.concat() operations to accumulate chunks of the FTP server's response without any maximum size check. An attacker controlling or compromising the FTP server can send a large or infinite directory listing response to a client calling Client.list(), causing the client process to allocate memory without bound until it becomes unstable or is terminated. The attack requires the victim application to connect to an attacker-controlled FTP server and invoke the directory listing function. A fix is available in version 5.3.0, which implements maximum size enforcement and early termination of oversized transfers.

Affected products

  • Patrick Juchli basic-ftp <=5.2.2

Identifiers

  • CVE-2026-41324
  • GHSA-rp42-5vxx-qpwr

Timeline

  • 2026-04-16: disclosed
  • 2026-04-16: patched: Version 5.3.0 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.