GHSA-r4m5-47cq-6qg8
GHSA-r4m5-47cq-6qg8 is a security vulnerability in ftp-srv. O3 Security confirms whether GHSA-r4m5-47cq-6qg8 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
Server-Side Request Forgery in ftp-srv
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
ftp-srvnpmDescription
All versions of ftp-srv from v1.0.0 onward to v4.3.3 are vulnerable to Server-Side Request Forgery (SSRF). The package fails to prevent remote clients to access other resources in the network, for example when connecting to the server through telnet. This allows attackers to access any network resources available to the server, including private resources in the hosting environment.
Recommendation
Upgrade to patched versions
^2.19.6, ^3.1.2, ^4.3.4
Workarounds
Blacklisting the FTP Command PORT will prevent the server from exposing this behaviour through active connections until a fix is applied.
const ftp = new FtpSrv({
blacklist: ['PORT']
});
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | ftp-srv | ≥ 1.0.0&&< 2.19.6 | 2.19.6 |
| 📦npm | ftp-srv | ≥ 3.0.0&&< 3.1.2 | 3.1.2 |
| 📦npm | ftp-srv | ≥ 4.0.0&&< 4.3.4 | 4.3.4 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for ftp-srv. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update ftp-srv to 2.19.6 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-r4m5-47cq-6qg8 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-r4m5-47cq-6qg8 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-r4m5-47cq-6qg8. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-r4m5-47cq-6qg8 in your dependencies?
O3 detects GHSA-r4m5-47cq-6qg8 across npm dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.