basic-ftp (npm) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the npm package basic-ftp, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (4)

• CVE-2026-27699 — CVSS 9.1 (critical): The `basic-ftp` FTP client library for Node.js contains a path traversal vulnerability (CWE-22) in versions prior to 5.2.0 in the…
• CVE-2026-39983 — CVSS 8.6 (high): basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF sequences (\r\n) in file path…
• CVE-2026-41324 — CVSS 7.5 (high): basic-ftp is an FTP client for Node.js. Versions prior to 5.3.0 are vulnerable to denial of service through unbounded memory growth while…
• CVE-2026-44240 — CVSS 7.5 (high): basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is vulnerable to client-side denial of service when parsing FTP…