CVE-2026-41324 HIGH

CVE-2026-41324: basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()

Vendor Patrickjuchli
Product basic-ftp
Weakness CWE-400
Published April 24, 2026
Last update April 24, 2026

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

basic-ftp is an FTP client for Node.js. Versions prior to 5.3.0 are vulnerable to denial of service through unbounded memory growth while processing directory listings from a remote FTP server. A malicious or compromised server can send an extremely large or never-ending listing response to `Client.list()`, causing the client process to consume memory until it becomes unstable or crashes. Version 5.3.0 fixes the issue.

Key dates

02Disclosure timeline

April 24, 2026 CVE published
April 24, 2026 Record updated