CVE-2026-126346

Deferred Deferred - Pending Action

Command Injection in basic-ftp Node.js Client

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: GitHub, Inc.

Description

basic-ftp is an FTP client for Node.js. Prior to 6.2.3, FTPContext.send() throws when a command contains carriage return, line feed, or NUL characters, but calls made from response handlers execute synchronously inside the control socket's data event without an exception boundary. In Client.login(), an attacker-influenced password reaches the PASS command after a server sends a 331 response, and in a resumed download an attacker-influenced remote path reaches the RETR command after a 350 response to REST. The resulting exception does not reject client.access() or downloadTo(), escapes ordinary promise error handling, and terminates the Node.js process, while the validation guard still prevents command injection. This issue is fixed in version 6.2.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-12

Last Modified

2026-11-12

Generated

2026-11-13

AI Q&A

2026-11-13

EPSS Evaluated

N/A

NVD

CVE-2026-126346

EUVD

EUVD-2026-124724

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-248	An exception is thrown from a function, but it is not caught.
CWE-755	The product does not handle or incorrectly handles an exceptional condition.

Attack-Flow Graph

Executive Summary

This vulnerability affects the basic-ftp library in Node.js. It allows an attacker to cause a denial of service by injecting carriage return, line feed, or NUL characters into FTP commands like PASS or RETR. The issue occurs because exceptions thrown in response handlers are not caught, leading to Node.js process termination without proper error handling.

Detection Guidance

This vulnerability may be detected by checking the version of the basic-ftp library in use. If your application uses basic-ftp and the version is below 6.2.3, it is vulnerable. Commands like npm list basic-ftp or checking package.json can help identify the installed version.

Impact Analysis

An attacker could exploit this to crash your Node.js application using basic-ftp. This could disrupt services relying on FTP operations, such as file transfers or logins, leading to downtime or data unavailability.

Mitigation Strategies

Immediately update the basic-ftp library to version 6.2.3 or later to patch the vulnerability. If updating is not possible, consider removing or replacing the library with a secure alternative until the update can be applied.

Hi! I’m here to help you understand CVE-2026-126346. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...