basic‑ftp, a Node.js FTP client, fails to limit the size of multiline responses received from an FTP server. A malicious or compromised server can transmit an unterminated multiline reply during the initial banner phase, causing the client to keep appending data to its internal buffer and repeatedly reparsing it without any size check. This leads to unchecked memory and CPU consumption, eventually exhausting process resources. The vulnerability is classified under CWE‑400 (Resource Exhaustion) and CWE‑770 (Memory Leak).

The affected product is basic‑ftp version 5.3.0 and earlier, maintained by patrickjuchli. Systems that use this library to automatically connect to external FTP endpoints are at risk.

The CVSS score of 7.5 indicates a high severity; however, no EPSS score is currently available, and the issue is not listed in CISA KEV. Attackers can exploit the flaw remotely by simply acting as an FTP server during the banner phase, which typically requires no special privileges. In practice, this can cause process‑level denial of service, container OOM kills, worker restarts, queue backlogs, or general service degradation in applications that rely on basic‑ftp.