CVE-2026-126345
- Source
- https://cve.org/CVERecord?id=CVE-2026-126345
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126345.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-126345
- Aliases
- Downstream
CGA (8)
CLSA (1)
- Published
- 2026-11-12T21:29:44Z
- Modified
- 2026-11-13T10:46:34Z
- Severity
-
- 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
- Summary
- basic-ftp: Uncaught TypeError in MLSD directory-listing parser via __proto__ fact name causes DoS in Client.list()
- Details
-
basic-ftp is an FTP client for Node.js. Prior to 6.2.4, the MLSD directory-listing parser in src/parseListMLSD.ts uses untrusted fact names from the FTP server as keys in the plain-object factHandlersByName dictionary without checking that the resolved property is an own handler. A fact named proto therefore resolves to Object.prototype, bypasses the missing-handler guard, and is called as though it were a function, producing a TypeError. The error propagates through Client.list() and APIs that depend on it because it is not an FTPError. A malicious or compromised FTP server, or an on-path attacker on a plaintext FTP session, can make the affected operation reject, and the Node.js process terminates under the default behavior in Node.js 15 and later only if the application leaves that rejection unhandled. This issue is fixed in version 6.2.4.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-1321", "CWE-248" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126345.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126345.json
- https://github.com/patrickjuchli/basic-ftp/commit/a22664a45d889f7d281e5bdd212c68c0a58d0ae6
- https://github.com/patrickjuchli/basic-ftp/releases/tag/v6.2.4
- https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-5pm8-86m8-9m6r
- https://nvd.nist.gov/vuln/detail/CVE-2026-126345
Affected packages
Git / github.com/patrickjuchli/basic-ftp
Affected ranges
- Type
- GIT
- Repo
- https://github.com/patrickjuchli/basic-ftp
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0" }, { "fixed": "6.2.4" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "a22664a45d889f7d281e5bdd212c68c0a58d0ae6" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v6.2.4", "range": [ { "fixed": "7b7a6240ddae025a669c9a1e930c012b65c0d218" } ], "source": "REFERENCES_TAG" } ] }