Threats affecting pkg:npm/basic-ftp

basic-ftp versions prior to 6.2.1 contain an inefficient regular expression complexity vulnerability in the Client.list() function. A malicious or compromised FTP server can cause the client to spend quadratic CPU time parsing directory listings, leading to event loop blocking and process freezing. This is due to backtracking in the RE_LINE regex when parsing Unix-style directory listings with certain crafted lines. The issue is resolved in version 6.2.1.

basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is vulnerable to client-side denial of service when parsing FTP control-channel multiline responses. A malicious or compromised FTP server can send an unterminated multiline response during the initial FTP banner phase, before authentication. The client keeps appending attacker-controlled data into FtpContext._partialResponse and repeatedly reparses the accumulated buffer without enforcing a maximum control response size. As a result, an application using basic-ftp can remain stuck in connect() while memory and CPU usage grow under attacker-controlled input. This can lead to process-level denial of service, container OOM kills, worker restarts, queue backlog, or service degradation in applications that automatically connect to FTP endpoints. This vulnerability is fixed in 5.3.1.

basic-ftp versions prior to 5.3.0 contain a vulnerability where processing directory listings from a remote FTP server can lead to unbounded memory growth. A malicious or compromised FTP server can send an extremely large or never-ending directory listing response to the Client.list() method, causing the client to consume excessive memory and potentially crash or become unstable. This denial of service vulnerability is fixed in version 5.3.0.

basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF sequences (\r\n) in file path parameters passed to high-level path APIs such as cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), and removeDir(). The library's protectWhitespace() helper only handles leading spaces and returns other paths unchanged, while FtpContext.send() writes the resulting command string directly to the control socket with \r\n appended. This lets attacker-controlled path strings split one intended FTP command into multiple commands. This vulnerability is fixed in 5.2.1.

The `basic-ftp` FTP client library for Node.js contains a path traversal vulnerability (CWE-22) in versions prior to 5.2.0 in the `downloadToDir()` method. A malicious FTP server can send directory listings with filenames containing path traversal sequences (`../`) that cause files to be written outside the intended download directory. Version 5.2.0 patches the issue.