CVE catalog

CVE-2026-41324

basic-ftp is an FTP client for Node.js. Versions prior to 5.3.0 are vulnerable to denial of service through unbounded memory growth while processing directory listings from a remote FTP server. A mali

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.33% · Oct 25, 2026

A flaw was found in basic-ftp, an FTP client for Node.js. A malicious or compromised remote FTP server can exploit this vulnerability by sending an extremely large or never-ending directory listing response. This can cause the client process to consume an unbounded amount of memory, leading to instability or a crash, resulting in a Denial of Service (DoS). basic-ftp: basic-ftp: Denial of Service via unbounded memory growth from malicious directory listings The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Cpebasic-ftpNot reported5.3.0fixed
Debiannode-proxy-agents130~2024040606-6vulnerable
Debiannode-proxy-agents130~2024040606-6+deb13u1vulnerable
Debiannode-proxy-agents130~2025070717+~cs15.2.7-1vulnerable
Debiannode-proxy-agents130~2025070717+~cs15.3.7-1vulnerable
Debiannode-proxy-agents130~2025070717+~cs15.3.8-1vulnerable
Debiannode-proxy-agents130~2025070717+~cs15.3.8-2vulnerable
Debiannode-proxy-agents130~2025070717+~cs15.3.8-3vulnerable
Debiannode-proxy-agents130~2025070717+~cs16.2.9-1vulnerable
Debiannode-proxy-agents130~2025070717-1vulnerable
Debiannode-proxy-agents130~2025070717-2vulnerable
Debiannode-proxy-agents130~2025070717-3vulnerable
Debiannode-proxy-agents130~2025070717-4vulnerable
Debiannode-proxy-agents130~2025070717-5vulnerable
Debiannode-proxy-agents130~2025070717-6vulnerable
Debiannode-proxy-agents140~2024040606-6vulnerable
Debiannode-proxy-agents140~2025070717+~cs15.2.7-1vulnerable
Debiannode-proxy-agents140~2025070717-1vulnerable
Debiannode-proxy-agents140~2025070717-2vulnerable
Debiannode-proxy-agents140~2025070717-3vulnerable
Debiannode-proxy-agents140~2025070717-4vulnerable
Debiannode-proxy-agents140~2025070717-5vulnerable
Debiannode-proxy-agents140~2025070717-6vulnerable
Debiannode-proxy-agents140~2025070717+~cs15.3.7-1fixed
Cpebasic-ftpNot reported5.3.0fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Cpebasic-ftpcpeNot reported5.3.0Not reportedNot reportedNot reported
Debiannode-proxy-agentsdeb140~2025070717+~cs15.3.7-1Not reportedDEBIAN-CVE-2026-41324Not reported
Cpebasic-ftpcpeNot reported5.3.0Not reportedNVD-CVE-2026-41324Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [node-agent-base]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 7.1.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

    • 7.1.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

  • [node-args]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 5.0.3~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

    • 5.0.3~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

  • [node-basic-ftp]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 5.0.5~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

    • 5.0.5~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

  • [node-data-uri-to-buffer]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 6.0.2~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

    • 6.0.2~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

  • [node-degenerator]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 5.0.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

    • 5.0.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

  • [node-get-uri]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 6.0.3~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

    • 6.0.3~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

  • [node-http-proxy-agent]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 7.0.2~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

    • 7.0.2~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

  • [node-https-proxy-agent]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 7.0.4~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

    • 7.0.4~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

  • [node-pac-proxy-agent]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 7.0.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

    • 7.0.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

  • [node-pac-resolver]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 7.0.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

    • 7.0.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

  • [node-proxy]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 2.1.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

    • 2.1.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

  • [node-proxy-agent]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 6.4.0~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

    • 6.4.0~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

  • [node-socks-proxy-agent]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 8.0.3~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

    • 8.0.3~0~2024040606-6+deb13u1 · all · trixie

      Affected

      nvd · node-proxy-agents · debian · 13

Observed:

References

[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]