CVE-2026-126346

Name of the Vulnerable Software and Affected Versions basic-ftp versions prior to 6.2.3

Description An issue exists where the FTPContext.send() function throws an error when a command contains carriage return, line feed, or NUL characters. In certain scenarios, these calls are executed synchronously within the control socket's data event without an exception boundary, causing the error to escape standard promise error handling and terminate the Node.js process. This can lead to a denial of service if an application passes untrusted input as an FTP password in Client.login() or as a remote path during a resumed download in downloadTo(). Specifically, an attacker-influenced password reaches the PASS command after a 331 response, and an attacker-influenced remote path reaches the RETR command after a 350 response to REST. While a validation guard prevents command injection, the resulting uncaught exception crashes the entire process.

Recommendations Update basic-ftp to version 6.2.3. As a temporary mitigation, avoid passing untrusted or user-influenced values as the FTP password or the remote path for downloads.