EUVD-2026-124723Published
basic-ftp: Uncaught TypeError in MLSD directory-listing parser via __proto__ fact name causes DoS in Client.list()
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-126345 · CVE overview and exploitation status
cve-program · CVE-2026-126345
- https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-5pm8-86m8-9m6r
- https://github.com/patrickjuchli/basic-ftp/commit/a22664a45d889f7d281e5bdd212c68c0a58d0ae6
- https://github.com/patrickjuchli/basic-ftp/releases/tag/v6.2.4
euvd · EUVD-2026-124723
- https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-5pm8-86m8-9m6r
- https://github.com/patrickjuchli/basic-ftp/commit/a22664a45d889f7d281e5bdd212c68c0a58d0ae6
- https://github.com/patrickjuchli/basic-ftp/releases/tag/v6.2.4
nvd · CVE-2026-126345
- https://github.com/patrickjuchli/basic-ftp/commit/a22664a45d889f7d281e5bdd212c68c0a58d0ae6
- https://github.com/patrickjuchli/basic-ftp/releases/tag/v6.2.4
- https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-5pm8-86m8-9m6r
osv · GHSA-5pm8-86m8-9m6r
Related changes
Linked by CVE identifier- basic-ftp is an FTP client for Node.js. Prior to 6.2.4, the MLSD directory-listing parser in src/parseListMLSD.ts uses untrusted fact names from the FTP server as keys in the plain-object factHandlersByName dictionary without checking that … · Advisory content revised · 14 Nov 2026
- basic-ftp: Uncaught TypeError in MLSD directory-listing parser via __proto__ fact name causes DoS in Client.list() · Newly collected advisory · 12 Nov 2026
- basic-ftp: Uncaught TypeError in MLSD directory-listing parser via __proto__ fact name causes DoS in Client.list() · Newly collected advisory · 12 Nov 2026