GHSA-5PM8-86M8-9M6R basic-ftp: Uncaught TypeError in MLSD directory-listing parser via __proto__ fact name causes DoS in Client.list()

Summary basic-ftp's MLSD directory-listing parser src/parseListMLSD.ts looks up fact-handler functions in a plain object literal keyed directly by fact names taken from the FTP server's response, with no validation. A directory-listing line containing the fact name "proto" resolves this lookup to...

basic-ftp: Uncaught TypeError in MLSD directory-listing parser via __proto__ fact name causes DoS in Client.list()

Summary basic-ftp's MLSD directory-listing parser src/parseListMLSD.ts looks up fact-handler functions in a plain object literal keyed directly by fact names taken from the FTP server's response, with no validation. A directory-listing line containing the fact name "proto" resolves this lookup to...

CVE-2026-126345

The basic-ftp Node.js FTP client is vulnerable to a Denial of Service (DoS) in its MLSD directory-listing parser (specifically in src/parseListMLSD.ts). Versions prior to 6.2.4 fail to verify that fact names received from an FTP server are own properties of the factHandlersByName dictionary. An a...