Threats tagged 'ghsa-r4jh-29pc-gfqr'

A vulnerability in the basic-ftp Node.js library allows an uncaught exception to crash the entire Node.js process when a password or resumed-download path contains carriage return (CR), line feed (LF), or null (NUL) characters. This occurs because the library throws an error on detecting these control characters during FTP command sending, but the exception is not caught in certain asynchronous event handlers, leading to process termination. The flaw enables denial of service by crashing applications that accept untrusted input as FTP passwords or remote paths. The issue is fixed in version 6.2.3.