Basic Ftp
Monthly
Denial of service in basic-ftp for Node.js allows remote malicious FTP servers to crash client applications via unbounded memory consumption during directory listing operations. Attackers controlling or compromising an FTP server can send infinite or extremely large listing responses to Client.list() calls, exhausting client memory until process termination. Unauthenticated network attack with low complexity (CVSS:3.1 AV:N/AC:L/PR:N). No public exploit identified at time of analysis, though attack concept is straightforward for anyone operating a malicious FTP server.
Path traversal in basic-ftp Node.js FTP client library before 5.2.0 allows malicious FTP servers to write files outside the intended download directory. PoC and patch available.
Denial of service in basic-ftp for Node.js allows remote malicious FTP servers to crash client applications via unbounded memory consumption during directory listing operations. Attackers controlling or compromising an FTP server can send infinite or extremely large listing responses to Client.list() calls, exhausting client memory until process termination. Unauthenticated network attack with low complexity (CVSS:3.1 AV:N/AC:L/PR:N). No public exploit identified at time of analysis, though attack concept is straightforward for anyone operating a malicious FTP server.
Path traversal in basic-ftp Node.js FTP client library before 5.2.0 allows malicious FTP servers to write files outside the intended download directory. PoC and patch available.