CVE-2026-44240

A flaw was found in basic-ftp, an FTP client for Node.js. A malicious or compromised FTP server can exploit this vulnerability by sending an unterminated multiline response during the initial FTP banner phase, before authentication. The client continuously appends attacker-controlled data and repeatedly reparses the accumulated buffer without enforcing a maximum size. This can lead to a client-side Denial of Service (DoS), causing the application to become unresponsive, consume excessive memory and CPU, and potentially result in process termination or service degradation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, restrict applications using the basic-ftp client to connect only to trusted FTP servers. Implement firewall rules or network access controls to limit outbound connections from affected systems to known, legitimate FTP endpoints. This operational control reduces the exposure to malicious or compromised FTP servers that could exploit this vulnerability. A restart of the affected application may be required for changes to take effect.