CVE-2026-27699 Critical Vulnerability

[Roshil-goloti]

The library basic-ftp version 5.1.0 was detected in NPM library manager located at /home/ubuntu/.nvm/versions/node/v24.13.0/lib/node_modules/pm2/node_modules/basic-ftp/package.json and is vulnerable to CVE-2026-27699, which exists in versions < 5.2.0.

[derikb]

We are seeing this too in our AWS Inspector. Since pm2 recommends installing globally, we can't just do an npm audit fix to resolve this, pm2 needs to be updated.