basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is vulnerable to client-side denial of service when parsing FTP control-channel multiline responses. A malicious or compromised FTP server can send an unterminated multiline response during the initial FTP banner phase, before authentication. The client keeps appending attacker-controlled data into FtpContext._partialResponse and repeatedly reparses the accumulated buffer without enforcing a maximum control response size. As a result, an application using basic-ftp can remain stuck in connect() while memory and CPU usage grow under attacker-controlled input. This can lead to process-level denial of service, container OOM kills, worker restarts, queue backlog, or service degradation in applications that automatically connect to FTP endpoints. This vulnerability is fixed in 5.3.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is vulnerable to client-side denial of
    service when parsing FTP control-channel multiline responses. A malicious or compromised FTP server can
    send an unterminated multiline response during the initial FTP banner phase, before authentication. The
    client keeps appending attacker-controlled data into FtpContext._partialResponse and repeatedly reparses
    the accumulated buffer without enforcing a maximum control response size. As a result, an application
    using basic-ftp can remain stuck in connect() while memory and CPU usage grow under attacker-controlled
    input. This can lead to process-level denial of service, container OOM kills, worker restarts, queue
    backlog, or service degradation in applications that automatically connect to FTP endpoints. This
    vulnerability is fixed in 5.3.1. (CVE-2026-44240)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is vulnerable to client-side denial of     service when parsing FTP control-channel multiline responses. A malicious or compromised FTP server can     send an unterminated multiline response during the initial FTP banner phase, before authentication. The     client keeps appending attacker-controlled data into FtpContext._partialResponse and repeatedly reparses     the accumulated buffer without enforcing a maximum control response size. As a result, an application     using basic-ftp can remain stuck in connect() while memory and CPU usage grow under attacker-controlled     input. This can lead to process-level denial of service, container OOM kills, worker restarts, queue     backlog, or service degradation in applications that automatically connect to FTP endpoints. This     vulnerability is fixed in 5.3.1. (CVE-2026-44240)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
458698	Echo: basic-ftp: security update to 0~2025070717+~cs15.3.8-1	Tenable Cloud Security	Echo Local Security Checks	Local	high
458698	Echo: basic-ftp: security update to 0~2025070717+~cs15.3.8-1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
314726	Linux Distros Unpatched Vulnerability : CVE-2026-44240	Nessus	Misc.	Local	high
441371	SCA: security update for basic-ftp (GHSA-rpmf-866q-6p89)	Tenable Cloud Security	SCA Checks	Local	high
441371	SCA: security update for basic-ftp (GHSA-rpmf-866q-6p89)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-44240

high

Tenable Plugins

high

high

high

high

high