# CVE-2026-41324: basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()

Source: https://junglewise.ai/threats/cve-2026-41324-basic-ftp-vulnerable-to-denial-of-service-via-unbounded-memory  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-41324 · Severity: high · CVSS 7.5 · Published 2026-04-24

basic-ftp is a Node.js library used by applications to transfer files and list directories on remote FTP servers. The library's directory listing function (Client.list()) buffers entire server responses in memory without imposing size limits, allowing a malicious or compromised FTP server to exhaust the client's available memory. An attacker can trigger process crashes or system instability by serving extremely large directory listings.

Technologies: [basic-ftp (npm)](https://junglewise.ai/threats/technologies/basic-ftp). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-41324 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41324 being exploited in the wild.

**How severe is CVE-2026-41324?** High severity, with a CVSS score of 7.5, published 24 April 2026.

**Which products and versions are affected?** basic-ftp (npm) <= 5.2.2, SEMVER:introduced=0,fixed=5.3.0.

**Is there a fix for CVE-2026-41324?** Yes. basic-ftp (npm): upgrade to 5.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41324 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-41324?** Check whether you run basic-ftp (npm) or Patrickjuchli Basic-Ftp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- basic-ftp (npm): upgrade to 5.3.0 or later

  ```sh
  npm install basic-ftp@5.3.0
  ```


## Technical details

The vulnerability is a memory exhaustion / denial-of-service issue in the StringWriter class used by Client.list(). The vulnerable code performs unbounded Buffer.concat() operations to accumulate chunks of the FTP server's response without any maximum size check. An attacker controlling or compromising the FTP server can send a large or infinite directory listing response to a client calling Client.list(), causing the client process to allocate memory without bound until it becomes unstable or is terminated. The attack requires the victim application to connect to an attacker-controlled FTP server and invoke the directory listing function. A fix is available in version 5.3.0, which implements maximum size enforcement and early termination of oversized transfers.

## Affected products

- Patrick Juchli basic-ftp <=5.2.2

## Identifiers

- CVE-2026-41324
- GHSA-rp42-5vxx-qpwr

## Timeline

- 2026-04-16: disclosed
- 2026-04-16: patched: Version 5.3.0 released with fix

## References

- [https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-rp42-5vxx-qpwr](https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-rp42-5vxx-qpwr)

## Related threats

- [basic-ftp unhandled exception in control socket event handler](https://junglewise.ai/threats/cve-2026-126346-basic-ftp-uncaught-exception-crashes-the-node-js-process-when-a)
- [basic-ftp MLSD parser prototype pollution](https://junglewise.ai/threats/cve-2026-126345-basic-ftp-uncaught-typeerror-in-mlsd-directory-listing-parser)
- [basic-ftp quadratic-time denial of service in Client.list()](https://junglewise.ai/threats/cve-2026-102990-basic-ftp-is-an-ftp-client-for-node-js-prior-to-6-2-1-client)
- [basic-ftp denial of service via unbounded multiline response buffering](https://junglewise.ai/threats/cve-2026-44240-basic-ftp-denial-of-service-via-unbounded-multiline-control)
- [basic-ftp CRLF injection via incomplete validation](https://junglewise.ai/threats/basic-ftp-crlf-injection-via-incomplete-validation-c2967386)