basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is vulnerable to client-side denial of service when parsing FTP control-channel multiline responses. A malicious or compromised FTP server can send an unterminated multiline response during the initial FTP banner phase, before authentication. The client keeps appending attacker-controlled data into FtpContext._partialResponse and repeatedly reparses the accumulated buffer without enforcing a maximum control response size. As a result, an application using basic-ftp can remain stuck in connect() while memory and CPU usage grow under attacker-controlled input. This can lead to process-level denial of service, container OOM kills, worker restarts, queue backlog, or service degradation in applications that automatically connect to FTP endpoints. This vulnerability is fixed in 5.3.1.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is vulnerable to client-side denial of     service when parsing FTP control-channel multiline responses. A malicious or compromised FTP server can     send an unterminated multiline response during the initial FTP banner phase, before authentication. The     client keeps appending attacker-controlled data into FtpContext._partialResponse and repeatedly reparses     the accumulated buffer without enforcing a maximum control response size. As a result, an application     using basic-ftp can remain stuck in connect() while memory and CPU usage grow under attacker-controlled     input. This can lead to process-level denial of service, container OOM kills, worker restarts, queue     backlog, or service degradation in applications that automatically connect to FTP endpoints. This     vulnerability is fixed in 5.3.1. (CVE-2026-44240)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is vulnerable to client-side denial of
    service when parsing FTP control-channel multiline responses. A malicious or compromised FTP server can
    send an unterminated multiline response during the initial FTP banner phase, before authentication. The
    client keeps appending attacker-controlled data into FtpContext._partialResponse and repeatedly reparses
    the accumulated buffer without enforcing a maximum control response size. As a result, an application
    using basic-ftp can remain stuck in connect() while memory and CPU usage grow under attacker-controlled
    input. This can lead to process-level denial of service, container OOM kills, worker restarts, queue
    backlog, or service degradation in applications that automatically connect to FTP endpoints. This
    vulnerability is fixed in 5.3.1. (CVE-2026-44240)

ID	Name	Product	Family	Severity
314726	Linux Distros Unpatched Vulnerability : CVE-2026-44240	Nessus	Misc.	high
441371	SCA: security update for basic-ftp (GHSA-rpmf-866q-6p89)	Tenable Cloud Security	SCA Checks	high
441371	SCA: security update for basic-ftp (GHSA-rpmf-866q-6p89)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-44240

high

Tenable Plugins

high

high

high