The vulnerability CVE-2026-41324 affects the basic-ftp Node.js FTP client in versions before 5.3.0. It arises from uncontrolled resource consumption (CWE-400) due to unbounded memory growth when processing directory listings from a remote FTP server. Specifically, a malicious or compromised server can send an extremely large or infinite listing response to the Client.list() function, causing the client process to consume memory until it crashes or becomes unstable. This results in a denial of service condition. The issue is resolved in basic-ftp version 5.3.0.

An attacker controlling or compromising an FTP server can cause a denial of service on clients using vulnerable versions of basic-ftp by sending large or never-ending directory listing responses. This leads to excessive memory consumption on the client side, potentially crashing the client process or making it unstable. There is no impact on confidentiality or integrity reported, only availability is affected.

Upgrade basic-ftp to version 5.3.0 or later, where this vulnerability is fixed. There is no official vendor advisory provided, but the description explicitly states that version 5.3.0 addresses the issue. Patch status is confirmed by the version upgrade requirement. No additional mitigations are indicated.