CVE-2026-41324
Fixed in a distro release EPSS <1%CVSS 7.5
basic-ftp is an FTP client for Node.js. Versions prior to 5.3.0 are vulnerable to denial of service through unbounded memory growth while processing directory listings from a remote FTP server. A malicious or compromised server can send an extremely large or never-ending listing response to `Client.list()`, causing the client process to consume memory until it becomes unstable or crashes. Version 5.3.0 fixes the issue.
Products: patrickjuchli basic-ftp
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | basic-ftp | 5.3.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | code-server | 4.112.0-r3 |
| Chainguard | kibana-7 | no fix |
| Chainguard | kibana-8.17 | 8.17.10-r18 |
| Chainguard | kibana-8.17-bitnami | 8.17.10-r18 |
| Chainguard | kibana-8.17-iamguarded | 8.17.10-r18 |
| Chainguard | kibana-8.18 | no fix |
| Chainguard | kibana-8.18-bitnami | no fix |
| Chainguard | kibana-8.18-iamguarded | no fix |
| Chainguard | kibana-8.19 | 8.19.14-r3 |
| Chainguard | kibana-8.19-bitnami | 8.19.14-r3 |
| Chainguard | kibana-8.19-iamguarded | 8.19.14-r3 |
| Chainguard | kibana-9.0 | 9.0.8-r20 |
| Chainguard | kibana-9.0-bitnami | 9.0.8-r20 |
| Chainguard | kibana-9.0-iamguarded | 9.0.8-r20 |
| Chainguard | kibana-9.1 | 9.1.10-r13 |
| Chainguard | kibana-9.1-iamguarded | 9.1.10-r13 |
| Chainguard | kibana-9.2 | 9.2.7-r6 |
| Chainguard | kibana-9.2-iamguarded | 9.2.7-r6 |
| Chainguard | kibana-9.3 | 9.3.3-r5 |
| Chainguard | kibana-9.3-iamguarded | 9.3.3-r5 |
| Chainguard | kibana-9.4 | 9.4.1-r0 |
| Chainguard | kibana-9.4-iamguarded | 9.4.1-r0 |
| Chainguard | langfuse-fips-3.152-worker | no fix |
| Chainguard | opensearch-dashboards-3-fips-security-dashboards-plugin | 3.6.0-r0 |
| Chainguard | opensearch-dashboards-3-security-dashboards-plugin | 3.6.0-r0 |
| Chainguard | wazuh-dashboard-security-plugin | 4.14.4-r3 |
| Debian 13 | node-proxy-agents | no fix |
| Debian 14 | node-proxy-agents | 0~2025070717+~cs15.3.7-1 |
| Ubuntu 24.04 LTS | node-proxy-agents | no fix |
| Ubuntu 25.10 | node-proxy-agents | no fix |
| Ubuntu 26.04 LTS | node-proxy-agents | no fix |
| Ubuntu 26.10 | node-proxy-agents | no fix |
| Wolfi | code-server | 4.112.0-r3 |
| Wolfi | opensearch-dashboards-3-security-dashboards-plugin | 3.6.0-r0 |