CVE-2026-126346

basic-ftp is an FTP client for Node.js. Prior to 6.2.3, FTPContext.send() throws when a command contains carriage return, line feed, or NUL characters, but calls made from response handlers execute synchronously inside the control socket's data event without an exception boundary. In Client.login(), an attacker-influenced password reaches the PASS command after a server sends a 331 response, and in a resumed download an attacker-influenced remote path reaches the RETR command after a 350 response to REST. The resulting exception does not reject client.access() or downloadTo(), escapes ordinary promise error handling, and terminates the Node.js process, while the validation guard still prevents command injection. This issue is fixed in version 6.2.3.

• CWE-248
• CWE-755

• https://github.com/patrickjuchli/basic-ftp/commit/0495b906bdf891e68806721b07b333dba65ec88e
• https://github.com/patrickjuchli/basic-ftp/releases/tag/v6.2.3
• https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-r4jh-29pc-gfqr

Published

Nov 12, 2026

Last Modified

Nov 13, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-126331Insertion of sensitive information into sent data in the use…
• CVE-2026-126332Improper access control in the autofill vault search in Devo…
• CVE-2026-12634The NVS backend of the Zephyr settings subsystem (subsys/set…5.3
• CVE-2026-126343@hono/node-server allows running the Hono application on Nod…5.3
• CVE-2026-126344@hono/node-server allows running the Hono application on Nod…5.4
• CVE-2026-126345basic-ftp is an FTP client for Node.js. Prior to 6.2.4, the …5.3
• CVE-2026-126347Tornado is a Python web framework and asynchronous networkin…3.1
• CVE-2026-126348Addressable is an alternative implementation to the URI impl…4.3
• CVE-2026-126349Addressable is an alternative implementation to the URI impl…3.1
• CVE-2026-12635GitLab has remediated an issue in GitLab CE/EE affecting all…3.1
• CVE-2026-126350Addressable is an alternative implementation to the URI impl…5.9
• CVE-2026-126351Addressable is an alternative implementation to the URI impl…5.9