VDB
DEBIAN-CVE-2026-41324
DEBIAN-CVE-2026-41324
PUBLISHED
CVSS 7.5 HIGH
basic-ftp is an FTP client for Node.js. Versions prior to 5.3.0 are vulnerable to denial of service through unbounded memory growth while processing directory listings from a remote FTP server. A malicious or compromised server can send an extremely large or never-ending listing response to `Client.list()`, causing the client process to consume memory until it becomes unstable or crashes. Version 5.3.0 fixes the issue.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:13 | node-proxy-agents | *, 0~2025070717+~cs15.3.7-1, 0~2025070717-3 |
| Debian:14 | node-proxy-agents | 0~2024040606-6, 0~2025070717+~cs15.2.7-1, 0~2025070717-1 |
Exploit Intelligence
- CVE-2026-41324.json (github-poc)
Timeline
- Apr 24, 2026 CVE Published
- Apr 29, 2026 CVE Updated