The issue is caused by unbounded memory consumption in the Client.list() method of the basic-ftp Node.js package. A malicious FTP server can send an excessively large or never‑ending directory listing, causing the client to allocate memory until the process becomes unstable or crashes. This results in a denial‑of‑service condition for applications that rely on the client. The weakness is classified as uncontrolled resource consumption (CWE‑400) and resource exhaustion (CWE‑770).

The vulnerability affects the basic-ftp library distributed by patrickjuchli for Node.js. Versions earlier than 5.3.0 are impacted. Applications that import and use basic‑ftp for FTP operations must ensure they run a version that is not susceptible to the flaw.

The CVSS base score for this flaw is 7.5, indicating a high impact. The EPSS score is below 1%, suggesting a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector requires the attacker to control or compromise an FTP server that the client connects to; the attacker can then issue a tailored listing response designed to trigger the memory‑leak in Client.list(). The flaw’s nature means that any application that relies on unfiltered directory listings is at risk, but sensitive services will only be affected if the attacker can force the client to process the malicious data.