CVE-2026-44240 affects the basic-ftp Node.js client before version 5.3.1. The vulnerability arises from the client not enforcing a maximum size on FTP control-channel multiline responses during the initial banner phase. A malicious or compromised FTP server can exploit this by sending an unterminated multiline response, causing the client to append attacker-controlled data indefinitely to an internal buffer and repeatedly reparse it. This uncontrolled resource consumption leads to denial of service conditions such as process-level crashes or service degradation. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling).

An attacker controlling or compromising an FTP server can cause applications using vulnerable versions of basic-ftp to consume excessive CPU and memory resources during connection establishment. This can result in denial of service through process crashes, container out-of-memory kills, worker restarts, or backlog in processing queues, impacting availability of services relying on automatic FTP connections.

This vulnerability is fixed in basic-ftp version 5.3.1. Users should upgrade to version 5.3.1 or later to remediate this issue. Patch status is not explicitly stated in the vendor advisory, but the description confirms the fix is included in 5.3.1. No additional mitigations are specified.