CVE catalog

CVE-2026-39983

basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF sequences (\r\n) in file path parameters passed to high-level path APIs such as cd(), remove(),

[CVE catalog]

Severity
High · CVSS 8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Published
Source
[NVD] · [CVE record]
EPSS
2.19% · Oct 25, 2026

A flaw was found in basic-ftp, an FTP client for Node.js. A remote attacker can exploit this vulnerability by injecting Carriage Return Line Feed (CRLF) sequences into file path parameters used by high-level APIs. This allows the attacker to split a single intended FTP command into multiple commands. Such command injection can lead to the execution of arbitrary commands, potentially compromising the integrity and availability of data or the system. basic-ftp: basic-ftp: Command injection via CRLF sequences in file path parameters The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Cpebasic-ftpNot reported5.2.1fixed
Debiannode-proxy-agents130~2024040606-6vulnerable
Debiannode-proxy-agents130~2024040606-6+deb13u1vulnerable
Debiannode-proxy-agents130~2025070717+~cs15.2.7-1vulnerable
Debiannode-proxy-agents130~2025070717+~cs15.3.7-1vulnerable
Debiannode-proxy-agents130~2025070717+~cs15.3.8-1vulnerable
Debiannode-proxy-agents130~2025070717+~cs15.3.8-2vulnerable
Debiannode-proxy-agents130~2025070717+~cs15.3.8-3vulnerable
Debiannode-proxy-agents130~2025070717+~cs16.2.9-1vulnerable
Debiannode-proxy-agents130~2025070717-1vulnerable
Debiannode-proxy-agents130~2025070717-2vulnerable
Debiannode-proxy-agents130~2025070717-3vulnerable
Debiannode-proxy-agents130~2025070717-4vulnerable
Debiannode-proxy-agents130~2025070717-5vulnerable
Debiannode-proxy-agents130~2025070717-6vulnerable
Debiannode-proxy-agents140~2024040606-6vulnerable
Debiannode-proxy-agents140~2025070717+~cs15.2.7-1vulnerable
Debiannode-proxy-agents140~2025070717-1vulnerable
Debiannode-proxy-agents140~2025070717-2vulnerable
Debiannode-proxy-agents140~2025070717-3vulnerable
Debiannode-proxy-agents140~2025070717-4vulnerable
Debiannode-proxy-agents140~2025070717-5vulnerable
Debiannode-proxy-agents140~2025070717-6vulnerable
Debiannode-proxy-agents140~2025070717+~cs15.3.7-1fixed
Cpebasic-ftpNot reported5.2.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Cpebasic-ftpcpeNot reported5.2.1Not reportedNot reportedNot reported
Debiannode-proxy-agentsdeb140~2025070717+~cs15.3.7-1Not reportedDEBIAN-CVE-2026-39983Not reported
Cpebasic-ftpcpeNot reported5.2.1Not reportedNVD-CVE-2026-39983Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [node-agent-base]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 7.1.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

    • 7.1.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

  • [node-args]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 5.0.3~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

    • 5.0.3~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

  • [node-basic-ftp]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 5.0.5~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

    • 5.0.5~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

  • [node-data-uri-to-buffer]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 6.0.2~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

    • 6.0.2~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

  • [node-degenerator]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 5.0.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

    • 5.0.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

  • [node-get-uri]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 6.0.3~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

    • 6.0.3~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

  • [node-http-proxy-agent]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 7.0.2~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

    • 7.0.2~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

  • [node-https-proxy-agent]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 7.0.4~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

    • 7.0.4~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

  • [node-pac-proxy-agent]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 7.0.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

    • 7.0.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

  • [node-pac-resolver]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 7.0.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

    • 7.0.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

  • [node-proxy]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 2.1.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

    • 2.1.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

  • [node-proxy-agent]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 6.4.0~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

    • 6.4.0~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

  • [node-socks-proxy-agent]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 8.0.3~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

    • 8.0.3~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

Observed:

References

[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]