CVE-2026-41324 basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()
A malicious FTP server can cause a Node.js application using basic-ftp to crash via memory exhaustion during directory listing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41324?
CVE-2026-41324 is a high-severity denial of service vulnerability in patrickjuchli basic-ftp, published on 24 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
basic-ftp is an FTP client for Node.js. Versions prior to 5.3.0 are vulnerable to denial of service through unbounded memory growth while processing directory listings from a remote FTP server. A malicious or compromised server can send an extremely large or never-ending listing response to `Client.list()`, causing the client process to consume memory until it becomes unstable or crashes. Version 5.3.0 fixes the issue.
Which versions are affected by CVE-2026-41324?
2 open source packages ship an affected version, including basic-ftp. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
basic-ftp npm | All versions | 5.3.0 |
basic-ftp npm | All versions | 5.3.0 |
Products include Patrickjuchli Basic-Ftp.
How do I fix CVE-2026-41324?
Upgrade basic-ftp to 5.3.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-41324 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-41324 exists.
Other vulnerabilities in patrickjuchli basic-ftp
Sources
Also known as CLEANSTART-2026-LZ49764, CLEANSTART-2026-PE96268, DEBIAN-CVE-2026-41324, ECHO-a4e9-52ab-d2eb, GHSA-rp42-5vxx-qpwr, MINI-34mp-qfqx-w95w and 23 more.