CVE-2026-126346 basic-ftp: Uncaught exception crashes the Node.js process when a password (or resumed-download path) contains CR/LF
Attacker-influenced passwords or download paths with CR/LF crash Node.js processes using basic-ftp; apps passing untrusted input to it should care.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Harmful if only installed
- No
- Needs a specific call
- Yes
- Fix
- Available
What is CVE-2026-126346?
CVE-2026-126346 is a medium-severity denial of service vulnerability in patrickjuchli basic-ftp, published on 12 Nov 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
basic-ftp is an FTP client for Node.js. Prior to 6.2.3, FTPContext.send() throws when a command contains carriage return, line feed, or NUL characters, but calls made from response handlers execute synchronously inside the control socket's data event without an exception boundary. In Client.login(), an attacker-influenced password reaches the PASS command after a server sends a 331 response, and in a resumed download an attacker-influenced remote path reaches the RETR command after a 350 response to REST. The resulting exception does not reject client.access() or downloadTo(), escapes ordinary promise error handling, and terminates the Node.js process, while the validation guard still prevents command injection. This issue is fixed in version 6.2.3.
Which versions are affected by CVE-2026-126346?
1 open source package ship an affected version, including basic-ftp.
An affected version is only exploitable if your software calls FTPContext.send(), Client.login() or downloadTo(). Many projects that include it are not exposed.
| Package | Affected | Fixed in |
|---|---|---|
basic-ftp npm | All versions | 6.2.3 |
How do I fix CVE-2026-126346?
Upgrade basic-ftp to 6.2.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-126346 being exploited?
There is no known exploitation of CVE-2026-126346 in the wild and no public exploit code.
Sources
Also known as GHSA-r4jh-29pc-gfqr.