CVSS 3.1
5.3 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LCVE-2026-126345
basic-ftp: Uncaught TypeError in MLSD directory-listing parser via __proto__ fact name causes DoS in Client.list()
Medium (5.3) in patrickjuchli basic-ftp. Fixed in basic-ftp 6.2.4.
On this page
basic-ftp is an FTP client for Node.js. Prior to 6.2.4, the MLSD directory-listing parser in src/parseListMLSD.ts uses untrusted fact names from the FTP server as keys in the plain-object factHandlersByName dictionary without checking that the resolved property is an own handler. A fact named __proto__ therefore resolves to Object.prototype, bypasses the missing-handler guard, and is called as though it were a function, producing a TypeError. The error propagates through Client.list() and APIs that depend on it because it is not an FTPError. A malicious or compromised FTP server, or an on-path attacker on a plaintext FTP session, can make the affected operation reject, and the Node.js process terminates under the default behavior in Node.js 15 and later only if the application leaves that rejection unhandled. This issue is fixed in version 6.2.4.
Severity
- CWEs
- CWE-248 Uncaught Exception
CWE-1321 Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) - OWASP Top 10
- A10:2025 Mishandling of Exceptional Conditions
- Published
- Modified
- Assigned by
- GitHub_M (CNA)
- NVD analysis
- Deferred: the NVD does not plan to analyze it
- Record from
- the NVD, synced
Ask an AI about this CVE
Show the prompt
Explain CVE-2026-126345 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-126345?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-126345?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-126345 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.
Badge for a README or a site
An image that stays current: it is drawn from the data each time it is fetched (a host that proxies images, as GitHub does, may show its copy for a while). Markdown:
[](https://cve.bz/cve/CVE-2026-126345)
HTML:
<a href="https://cve.bz/cve/CVE-2026-126345"><img src="https://cve.bz/cve/badge/CVE-2026-126345.svg" alt="CVE-2026-126345"></a>
Affected
Versions
From the CNA's record in the CVE List.
| Product | Affected |
|---|---|
| patrickjuchli basic-ftp | < 6.2.4 |
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-5pm8-86m8-9m6r | npm | basic-ftp | <6.2.4 | 6.2.4 |
Attack patterns (CAPEC)
- CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs Likelihood: High · Severity: High
- CAPEC-77 Manipulating User-Controlled Variables Likelihood: High · Severity: Very High
- CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels Likelihood: High · Severity: Medium
The attack patterns MITRE's CAPEC relates to this record's weaknesses, as MITRE names them. Credits.
History
- The NVD deferred its analysis
Changes since this site first stored the record. The same for every record: /api/public/changes.