CVE catalog

CVE-2026-44240

DEBIAN-CVE-2026-44240

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.51% · Oct 27, 2026

basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is vulnerable to client-side denial of service when parsing FTP control-channel multiline responses. A malicious or compromised FTP server can send an unterminated multiline response during the initial FTP banner phase, before authentication. The client keeps appending attacker-controlled data into FtpContext._partialResponse and repeatedly reparses the accumulated buffer without enforcing a maximum control response size. As a result, an application using basic-ftp can remain stuck in connect() while memory and CPU usage grow under attacker-controlled input. This can lead to process-level denial of service, container OOM kills, worker restarts, queue backlog, or service degradation in applications that automatically connect to FTP endpoints. This vulnerability is fixed in 5.3.1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannode-proxy-agents130~2024040606-6vulnerable
Debiannode-proxy-agents130~2024040606-6+deb13u1vulnerable
Debiannode-proxy-agents130~2025070717+~cs15.2.7-1vulnerable
Debiannode-proxy-agents130~2025070717+~cs15.3.7-1vulnerable
Debiannode-proxy-agents130~2025070717+~cs15.3.8-1vulnerable
Debiannode-proxy-agents130~2025070717+~cs15.3.8-2vulnerable
Debiannode-proxy-agents130~2025070717+~cs15.3.8-3vulnerable
Debiannode-proxy-agents130~2025070717+~cs16.2.9-1vulnerable
Debiannode-proxy-agents130~2025070717-1vulnerable
Debiannode-proxy-agents130~2025070717-2vulnerable
Debiannode-proxy-agents130~2025070717-3vulnerable
Debiannode-proxy-agents130~2025070717-4vulnerable
Debiannode-proxy-agents130~2025070717-5vulnerable
Debiannode-proxy-agents130~2025070717-6vulnerable
Debiannode-proxy-agents140~2024040606-6vulnerable
Debiannode-proxy-agents140~2025070717+~cs15.2.7-1vulnerable
Debiannode-proxy-agents140~2025070717+~cs15.3.7-1vulnerable
Debiannode-proxy-agents140~2025070717-1vulnerable
Debiannode-proxy-agents140~2025070717-2vulnerable
Debiannode-proxy-agents140~2025070717-3vulnerable
Debiannode-proxy-agents140~2025070717-4vulnerable
Debiannode-proxy-agents140~2025070717-5vulnerable
Debiannode-proxy-agents140~2025070717-6vulnerable
Debiannode-proxy-agents140~2025070717+~cs15.3.8-1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannode-proxy-agentsdeb140~2025070717+~cs15.3.8-1Not reportedDEBIAN-CVE-2026-44240Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [node-agent-base]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 7.1.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

    • 7.1.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

  • [node-args]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 5.0.3~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

    • 5.0.3~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

  • [node-basic-ftp]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 5.0.5~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

    • 5.0.5~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

  • [node-data-uri-to-buffer]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 6.0.2~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

    • 6.0.2~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

  • [node-degenerator]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 5.0.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

    • 5.0.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

  • [node-get-uri]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 6.0.3~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

    • 6.0.3~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

  • [node-http-proxy-agent]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 7.0.2~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

    • 7.0.2~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

  • [node-https-proxy-agent]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 7.0.4~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

    • 7.0.4~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

  • [node-pac-proxy-agent]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 7.0.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

    • 7.0.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

  • [node-pac-resolver]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 7.0.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

    • 7.0.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

  • [node-proxy]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 2.1.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

    • 2.1.1~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

  • [node-proxy-agent]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 6.4.0~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

    • 6.4.0~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

  • [node-socks-proxy-agent]Affected

    Source package: [node-proxy-agents]

    Details (2)

    • 8.0.3~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

    • 8.0.3~0~2024040606-6+deb13u1 · all · trixie

      Affected

      pypi · node-proxy-agents · debian · 13

Observed:

References

[FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]