basic-ftp CVE-2026-41324

Exploitation requires the vulnerable Node.js application to connect to a malicious or compromised FTP server controlled by the attacker and invoke the Client.list() method to retrieve directory listings. The client application must be running basic-ftp versions prior to 5.3.0. No authentication is required at the FTP protocol level from the attacker's perspective, as they control the server endpoint. However, the victim application must initiate the connection, meaning the attacker cannot remotely trigger exploitation against arbitrary clients - they must position themselves as the FTP server in the client's connection path. Applications most vulnerable are those accepting FTP server addresses from untrusted sources (user input, external configuration, service discovery mechanisms) or those connecting to shared/multi-tenant FTP infrastructure where server compromise is feasible. Applications connecting exclusively to hardened, internally managed FTP servers within trusted network boundaries face significantly reduced risk. The attack requires sustained network connectivity between client and malicious server for memory exhaustion to complete, typically measured in seconds to minutes depending on bandwidth and client memory allocation.

Real-world risk is moderate and context-dependent despite the CVSS 7.5 High rating. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates network-accessible attacks with no authentication required, but this is misleading in practice - the client application must actively connect to a malicious FTP server for exploitation to occur. The attack requires server-side control, meaning threat actors must either operate rogue FTP servers or compromise legitimate ones. EPSS data not provided, and no CISA KEV listing indicates this is not observed in widespread exploitation. The impact is limited to availability (A:H) with no confidentiality or integrity effects, making it unsuitable for data theft or lateral movement. Primary risk scenarios include: (1) applications that connect to user-supplied or dynamically discovered FTP servers without vetting, (2) automated backup/monitoring tools polling untrusted FTP endpoints, (3) supply chain attacks where legitimate FTP servers are compromised to target specific client deployments. For applications connecting only to known, trusted FTP servers within administrative control, risk is substantially lower than CVSS suggests. The straightforward fix (upgrade to 5.3.0) and absence of complex exploitation barriers mean remediation should be prioritized for any deployment processing untrusted FTP sources.

An attacker sets up a malicious FTP server or compromises an existing one used by the target organization. When the victim Node.js application connects and calls Client.list() to enumerate directory contents, the malicious server begins streaming an infinite or multi-gigabyte directory listing response. The basic-ftp client accumulates this data in memory without bounds checking, rapidly consuming available heap space until Node.js triggers out-of-memory errors and the process crashes. For automated systems performing scheduled FTP synchronization or monitoring, this creates persistent denial of service as each connection attempt results in resource exhaustion and restart cycles.