CVE-2026-126345

basic-ftp is an FTP client for Node.js. Prior to 6.2.4, the MLSD directory-listing parser in src/parseListMLSD.ts uses untrusted fact names from the FTP server as keys in the plain-object factHandlersByName dictionary without checking that the resolved property is an own handler. A fact named __proto__ therefore resolves to Object.prototype, bypasses the missing-handler guard, and is called as though it were a function, producing a TypeError. The error propagates through Client.list() and APIs that depend on it because it is not an FTPError. A malicious or compromised FTP server, or an on-path attacker on a plaintext FTP session, can make the affected operation reject, and the Node.js process terminates under the default behavior in Node.js 15 and later only if the application leaves that rejection unhandled. This issue is fixed in version 6.2.4.

• CWE-248
• CWE-1321

• https://github.com/patrickjuchli/basic-ftp/commit/a22664a45d889f7d281e5bdd212c68c0a58d0ae6
• https://github.com/patrickjuchli/basic-ftp/releases/tag/v6.2.4
• https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-5pm8-86m8-9m6r

Published

Nov 12, 2026

Last Modified

Nov 12, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-126330Docker Sandboxes can silently republish a sandbox service af…2.4
• CVE-2026-126331Insertion of sensitive information into sent data in the use…
• CVE-2026-126332Improper access control in the autofill vault search in Devo…
• CVE-2026-12634The NVS backend of the Zephyr settings subsystem (subsys/set…5.3
• CVE-2026-126343@hono/node-server allows running the Hono application on Nod…5.3
• CVE-2026-126344@hono/node-server allows running the Hono application on Nod…5.4
• CVE-2026-126346basic-ftp is an FTP client for Node.js. Prior to 6.2.3, FTPC…5.9
• CVE-2026-126347Tornado is a Python web framework and asynchronous networkin…3.1
• CVE-2026-126348Addressable is an alternative implementation to the URI impl…4.3
• CVE-2026-126349Addressable is an alternative implementation to the URI impl…3.1
• CVE-2026-12635GitLab has remediated an issue in GitLab CE/EE affecting all…3.1
• CVE-2026-126350Addressable is an alternative implementation to the URI impl…5.9