CVE-2026-41324: 
JavaScript vulnerability analysis and mitigation

CVE-2026-41324 is a denial-of-service vulnerability in basic-ftp, an FTP client library for Node.js, caused by unbounded memory growth when processing directory listings from a remote FTP server. Versions 5.2.2 and earlier (all versions prior to 5.3.0) are affected. The vulnerability was published on April 24, 2026, with the GitHub Security Advisory (GHSA-rp42-5vxx-qpwr) originally published by the maintainer on April 15, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat Bugzilla). Downstream IBM products including Cloud Pak for Security, QRadar Suite Software, App Connect Enterprise, and IBM Bob are also affected as they bundle the vulnerable library (IBM Advisory).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling). The vulnerable code path is in Client.list(), which calls _requestListWithCommand() in dist/Client.js. This method downloads the full FTP directory listing response into a StringWriter object before parsing it. The StringWriter class in dist/StringWriter.js accumulates incoming Buffer chunks via repeated Buffer.concat([this.buf, chunk]) calls with no maximum size check, no truncation, and no streaming parser — allowing unbounded heap growth. An attacker controlling or compromising an FTP server can exploit this by returning an extremely large or never-ending LIST response, forcing the client process to exhaust available memory (GitHub Advisory).

Successful exploitation results in a denial-of-service condition affecting the availability of any Node.js application using basic-ftp to list directories from untrusted FTP servers. The attacker can cause the client process to consume unbounded memory, leading to process instability or termination. There is no impact on confidentiality or integrity — the vulnerability is purely an availability issue. Applications embedded in larger platforms (e.g., IBM App Connect Enterprise, QRadar Suite) may experience broader service disruption if the affected process is a critical component (GitHub Advisory, IBM Advisory).

A public proof-of-concept (PoC) is available in the GitHub Security Advisory, demonstrating memory exhaustion by directly exercising the vulnerable StringWriter buffering mechanism without requiring a live FTP server. The PoC shows RSS memory growing from ~116 MB to ~436 MB after writing 128 MB of data through the vulnerable code path. The EPSS score is approximately 0.04% (very low probability of exploitation in the wild), and there is no evidence of active in-the-wild exploitation or CISA KEV catalog listing as of the report date. No threat actor attribution has been identified (GitHub Advisory).

1. Set up a malicious FTP server: Deploy a custom FTP server (e.g., using Python's ftplib or a modified server implementation) that is configured to return an extremely large or never-ending response to the LIST command.
2. Lure or position the victim client: Ensure the target application using basic-ftp (version ≤ 5.2.2) connects to the attacker-controlled FTP server — this may occur via misconfiguration, MITM attack, or social engineering.
3. Trigger Client.list(): Wait for or induce the application to call client.list() on any directory. This is a standard operation in many FTP workflows (e.g., file synchronization, backup tools).
4. Send unbounded listing response: The malicious server responds to the LIST command with an extremely large payload (e.g., millions of fake directory entries) or streams data indefinitely without closing the connection.
5. Memory exhaustion: The StringWriter in basic-ftp accumulates all incoming chunks via Buffer.concat() with no size limit, causing the Node.js process heap to grow until the OS kills the process (OOM) or the application becomes unresponsive (GitHub Advisory).

• Process Behavior: Node.js process consuming abnormally high and continuously growing memory (RSS exceeding hundreds of MB or GB) while performing FTP list() operations; process crash or OOM kill events in system logs.
• Network: Outbound FTP connections (port 21 or passive data ports) to unexpected or external IP addresses; FTP data channel connections that remain open for an unusually long duration without completing.
• Logs: Application logs showing client.list() calls that never return or time out; Node.js crash dumps or unhandled exception logs referencing StringWriter or Buffer.concat; OS-level OOM killer logs (dmesg on Linux) terminating the Node.js process.
• System: Sudden spike in memory usage visible in system monitoring tools (e.g., top, htop, Prometheus metrics) correlated with FTP activity (GitHub Advisory).

Upgrade basic-ftp to version 5.3.0 or later, which enforces a maximum listing size and aborts transfers exceeding the configured limit. For IBM products, apply the respective vendor security updates: IBM Bob, IBM QRadar Suite Software, IBM App Connect Enterprise, and IBM App Connect Enterprise Certified Container operators and operands all have patches available via IBM support pages. As a temporary workaround where upgrading is not immediately possible, restrict FTP client connections to trusted, known-good FTP servers only, and implement network-level controls to prevent connections to untrusted FTP endpoints (GitHub Advisory, IBM Advisory).

The vulnerability was reported by security researcher MaanVader and disclosed responsibly through GitHub's security advisory process. Red Hat tracked the issue via Bugzilla (Bug 2461380) with medium priority/severity, and IBM issued multiple security bulletins covering affected products including QRadar Suite Software and App Connect Enterprise. The Mastodon security community (@thehackerwire) noted the disclosure shortly after publication. Overall community sentiment treats this as a moderate-severity supply chain concern given basic-ftp's use as a dependency in enterprise products (GitHub Advisory, Red Hat Bugzilla, IBM Advisory).