CVE-2026-41324: Patrickjuchli Basic-FTP

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

basic-ftp is an FTP client for Node.js. Versions prior to 5.3.0 are vulnerable to denial of service through unbounded memory growth while processing directory listings from a remote FTP server. A malicious or compromised server can send an extremely large or never-ending listing response to `Client.list()`, causing the client process to consume memory until it becomes unstable or crashes. Version 5.3.0 fixes the issue.

Affected products

• Patrickjuchli Basic-FTP: before 5.3.0 (fixed in 5.3.0)

Published 2026-04-24. Last modified 2026-06-17.