Affected: CleanStart: proxy-agent

CVE-2026-41324 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

basic-ftp is an FTP client for Node.js. Versions prior to 5.3.0 are vulnerable to denial of service through unbounded memory growth while processing directory listings from a remote FTP server. A malicious or compromised server can send an extremely large or never-ending listing response to `Client.list()`, causing the client process to consume memory until it becomes unstable or crashes. Version 5.3.0 fixes the issue.

Affected: npm: basic-ftp

### Summary `basic-ftp@5.2.2` is vulnerable to denial of service through unbounded memory growth while processing directory listings from a remote FTP server. A malicious or compromised server can send an extremely large or never-ending listing response to `Client.list()`, causing the client process to consume memory until it becomes unstable or crashes.

### Details The issue is in the package's default directory listing flow.

`Client.list()` reaches `dist/Client.js`, where the full listing response is downloaded into a `StringWriter` before parsing:

File: `dist/Client.js:516-527`

```js async _requestListWithCommand(command) { const buffer = new StringWriter_1.StringWriter(); await (0, transfer_1.downloadTo)(buffer, { ftp: this.ftp, tracker: this._progressTracker, command, remotePath: "", type: "list" }); const text = buffer.getText(this.ftp.encoding); this.ftp.log(text); return this.parseList(text); } ```

The vulnerable sink is `StringWriter`, which grows an in-memory `Buffer` with no limit:

File: `dist/StringWriter.js:5-20`

```js class StringWriter extends stream_1.Writable { constructor() { super(...arguments); this.buf = Buffer.alloc(0); } _write(chunk, _, callback) { if (chunk instanceof Buffer) { this.buf = Buffer.concat([this.buf, chunk]); callback(null); } else { callback(new Error("StringWriter expects chunks…

Affected: Ubuntu:24.04:LTS: node-proxy-agents, Ubuntu:25.10: node-proxy-agents, Ubuntu:26.04:LTS: node-proxy-agents

basic-ftp is an FTP client for Node.js. Versions prior to 5.3.0 are vulnerable to denial of service through unbounded memory growth while processing directory listings from a remote FTP server. A malicious or compromised server can send an extremely large or never-ending listing response to `Client.list()`, causing the client process to consume memory until it becomes unstable or crashes. Version 5.3.0 fixes the issue.

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Dateien zu manipulieren oder einen Denial-of-Service-Zustand zu verursachen.