CVE-2026-41324: Patrickjuchli Basic-ftp DoS Vulnerability

CVE-2026-41324 Overview

CVE-2026-41324 is a denial of service vulnerability affecting basic-ftp, a popular FTP client library for Node.js applications. Versions prior to 5.3.0 are vulnerable to unbounded memory growth while processing directory listings from a remote FTP server. A malicious or compromised server can send an extremely large or never-ending listing response to the Client.list() method, causing the client process to consume memory until it becomes unstable or crashes.

Critical Impact

Applications using vulnerable versions of basic-ftp can be forced into memory exhaustion by a malicious FTP server, leading to application crashes and service unavailability.

Affected Products

• patrickjuchli basic-ftp versions prior to 5.3.0
• Node.js applications integrating basic-ftp for FTP operations
• Automated backup and file transfer systems using the vulnerable library

Discovery Timeline

• 2026-04-24 - CVE CVE-2026-41324 published to NVD
• 2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-41324

Vulnerability Analysis

This vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption). The core issue lies in how the basic-ftp library handles directory listing responses from FTP servers. When the Client.list() method is invoked, the library receives and parses directory listing data from the connected server. However, versions prior to 5.3.0 lack proper bounds checking on the size of incoming listing data.

The vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker controlling or compromising an FTP server can craft a malicious response that either contains an extremely large directory listing or streams data indefinitely, causing the client to allocate memory without limits.

Root Cause

The root cause of this vulnerability is the absence of size limits or resource constraints when buffering FTP directory listing responses. The Client.list() method accumulates response data in memory without implementing a maximum buffer size or timeout mechanism to prevent unbounded growth. This allows a malicious server to exhaust the memory resources of the connecting client application.

Attack Vector

The attack vector requires an attacker to control or compromise an FTP server that a vulnerable application connects to. When the victim application calls Client.list() to retrieve a directory listing, the malicious server responds with either:

1. An extremely large listing response that exceeds reasonable memory limits
2. A continuous stream of listing data that never terminates

In either scenario, the basic-ftp client continues to buffer the incoming data, eventually exhausting available memory and causing the Node.js process to become unstable or crash. This can be exploited in scenarios where applications connect to user-provided FTP servers or where an attacker has compromised a legitimate FTP server.

The vulnerability mechanism involves the FTP protocol's LIST command response handling. When Client.list() is called, the library opens a data connection and reads the listing response without enforcing memory limits. A malicious server exploits this by sending an arbitrarily large response. For detailed technical information, see the GitHub Security Advisory.

Detection Methods for CVE-2026-41324

Indicators of Compromise

• Unusual memory growth patterns in Node.js processes using FTP client functionality
• Application crashes with out-of-memory errors during FTP operations
• Abnormally large data transfers on FTP data connections
• FTP server connections that remain open for extended periods during list operations

Detection Strategies

• Monitor memory utilization of Node.js applications that perform FTP operations for unexpected spikes
• Implement application-level logging to track FTP LIST command execution times and response sizes
• Use dependency scanning tools to identify vulnerable versions of basic-ftp (< 5.3.0) in your codebase
• Configure network monitoring to detect abnormally large FTP data channel transfers

Monitoring Recommendations

• Deploy application performance monitoring (APM) to track memory consumption patterns during FTP operations
• Set up alerts for Node.js process memory usage exceeding normal operational thresholds
• Implement circuit breakers or timeouts around FTP operations to detect potential denial of service attempts
• Review FTP server connection logs for unusual listing request patterns or extended data transfers

How to Mitigate CVE-2026-41324

Immediate Actions Required

• Upgrade basic-ftp to version 5.3.0 or later immediately
• Audit your application dependencies using npm audit or equivalent tools to identify vulnerable packages
• If immediate upgrade is not possible, implement application-level timeouts for FTP list operations
• Review and restrict which FTP servers your application is permitted to connect to

Patch Information

The vulnerability has been fixed in basic-ftp version 5.3.0. The fix introduces proper bounds checking and resource limits when processing directory listing responses. Organizations should update their package.json to require version 5.3.0 or higher and run npm update basic-ftp to apply the security patch. For complete details, refer to the GitHub Security Advisory.

Workarounds

• Implement application-level timeouts around Client.list() calls to prevent indefinite operations
• Add memory monitoring and automatic process restart mechanisms for applications performing FTP operations
• Use a proxy or intermediary service to validate and limit FTP responses before they reach your application
• Restrict FTP server connections to a whitelist of trusted servers only

# Update basic-ftp to patched version
npm update basic-ftp

# Verify installed version is 5.3.0 or later
npm list basic-ftp

# Run security audit to check for other vulnerabilities
npm audit