CVE-2026-126345

Name of the Vulnerable Software and Affected Versions basic-ftp versions prior to 6.2.4

Description The MLSD directory-listing parser in src/parseListMLSD.ts uses untrusted fact names from an FTP server as keys in the factHandlersByName dictionary without verifying if the resolved property is an own handler. A malicious or compromised FTP server, or an on-path attacker on a plaintext session, can provide a fact named proto. This resolves to Object.prototype, bypassing the missing-handler guard and causing the application to attempt to call it as a function, which results in a TypeError.

Because this TypeError is not an FTPError, it is not caught by the retry logic in Client.list() and propagates as a rejected promise. This affects the following API endpoints and methods:

In Node.js 15 and later, if the application does not handle this rejection with a try/catch block, the Node.js process will terminate, leading to a Denial of Service.

Recommendations Update basic-ftp to version 6.2.4. As a temporary mitigation, wrap calls to Client.list(), Client.downloadToDir(), Client.uploadFromDir(), Client.clearWorkingDir(), and Client.removeDir() in try/catch blocks to prevent the Node.js process from crashing.