patrickjuchli basic-ftp up to 6.2.3 MLSD directory-listing parser src/parseListMLSD.ts Client.list improperly controlled sequential memory allocation

Summaryinfo

A vulnerability has been found in patrickjuchli basic-ftp up to 6.2.3 and classified as problematic. Impacted is the function Client.list of the file src/parseListMLSD.ts of the component MLSD directory-listing parser. Performing a manipulation results in improperly controlled sequential memory allocation. This vulnerability is identified as CVE-2026-126345. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in patrickjuchli basic-ftp up to 6.2.3. It has been classified as problematic. This affects the function Client.list of the file src/parseListMLSD.ts of the component MLSD directory-listing parser. The manipulation with an unknown input leads to a improperly controlled sequential memory allocation vulnerability. CWE is classifying the issue as CWE-1325. The product manages a group of objects or resources and performs a separate memory allocation for each object, but it does not properly limit the total amount of memory that is consumed by all of the combined objects. This is going to have an impact on availability. The summary by CVE is:

basic-ftp is an FTP client for Node.js. Prior to 6.2.4, the MLSD directory-listing parser in src/parseListMLSD.ts uses untrusted fact names from the FTP server as keys in the plain-object factHandlersByName dictionary without checking that the resolved property is an own handler. A fact named __proto__ therefore resolves to Object.prototype, bypasses the missing-handler guard, and is called as though it were a function, producing a TypeError. The error propagates through Client.list() and APIs that depend on it because it is not an FTPError. A malicious or compromised FTP server, or an on-path attacker on a plaintext FTP session, can make the affected operation reject, and the Node.js process terminates under the default behavior in Node.js 15 and later only if the application leaves that rejection unhandled. This issue is fixed in version 6.2.4.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-126345 since 11/10/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 6.2.4 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• patrickjuchli

Name

• basic-ftp

Version

• 6.2.0
• 6.2.1
• 6.2.2
• 6.2.3

Website

• Product: https://github.com/patrickjuchli/basic-ftp/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion