node-proxy-agents vulnerabilities (Debian)

5 vulnerabilities.

• node-proxy-agents Debian basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking) CVE-2026-102990 Fix available 8.2 HighSeptember 30, 2026
• node-proxy-agents Debian basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list() CVE-2026-41324 Fix available 7.5 HighApril 16, 2026
• node-proxy-agents Debian basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering CVE-2026-44240 Fix available 7.5 HighApril 10, 2026
• node-proxy-agents Debian FTP Command Injection via CRLF in basic-ftp CVE-2026-39983 Public exploitFix available 8.6 HighApril 8, 2026
• node-proxy-agents Debian Basic FTP has Path Traversal Vulnerability in its downloadToDir() method CVE-2026-27699 Fix available 9.1 CriticalFebruary 25, 2026