FTP Client Vulnerability in Basic-FTP by patrickjuchli

CVE-2026-126345

What is CVE-2026-126345?

The Basic-FTP client for Node.js is impacted by a vulnerability in its MLSD directory-listing parser. Prior to version 6.2.4, it processed untrusted fact names from the FTP server without proper validation, allowing potential exploitation. An attacker could leverage this flaw, particularly if they control the FTP server or have the ability to intercept FTP traffic, leading to a TypeError that could crash the Node.js process if unhandled. This vulnerability has been addressed in version 6.2.4 and users are strongly encouraged to update to this version to mitigate risks.

References