PT-2026-34847 · Npm · Basic-Ftp

Maanvader · Published 2026-04-24 · Updated 2026-04-28 · CVE-2026-41324

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions basic-ftp versions prior to 5.3.0

Description An issue in the Node.js FTP client allows for a denial of service via unbounded memory growth during the processing of directory listings from a remote FTP server. A malicious or compromised server can send an excessively large or infinite listing response to the Client.list() function, leading the client process to consume memory until it crashes or becomes unstable.

Recommendations Update to version 5.3.0.

Exploit

Fix

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2026-41324

Affected Products

Basic-Ftp

References · 8

• 🔥 https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-rp42-5vxx-qpwr · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-41324 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-41324 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41324 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-41324 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-41324 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-41324 · Vendor Advisory
• https://twitter.com/CVEnew/status/2048099317538275481 · Twitter Post