SB20261110266 - Uncaught Exception in basic-ftp

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261110266

SB20261110266 - Uncaught Exception in basic-ftp

Published: November 10, 2026 Updated: November 13, 2026

Security Bulletin ID SB20261110266
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Uncaught Exception (CVE-ID: CVE-2026-126346)

CWE-ID: CWE-248 - Uncaught Exception

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by terminating the Node.js process.

The vulnerability exists due to an uncaught exception in basic-ftp control-socket response handlers when FTPContext.send() rejects control characters during login or resumed downloads. A remote attacker can supply a password or resumed-download remote path containing CR, LF, or NUL to an application accepting untrusted values to trigger an exception outside promise rejection handling and crash the process.


Remediation

Install update from vendor's website.

References