CVE-2026-126345

### Summary basic-ftp's MLSD directory-listing parser (src/parseListMLSD.ts) looks up fact-handler functions in a plain object literal keyed directly by fact names taken from the FTP server's response, with no validation. A directory-listing line containing the fact name "__proto__" resolves this lookup to Object.prototype (inherited, non-own, non-function) instead of undefined, so the "not a function" guard is bypassed and the code throws `TypeError: factHandler is not a function`. This TypeError is not an FTPError, so it is not caught by Client.list()'s retry logic and propagates as a rejected promise out of list() and every API built on top of it (list, downloadToDir, uploadFromDir, clearWorkingDir, removeDir). Any FTP server the client connects to — or any on-path attacker on a plaintext (non-TLS) FTP session — can crash the calling application by returning one crafted line in a directory listing. If the application does not wrap every one of these calls in try/catch, the rejection is unhandled and crashes the Node.js process (default behavior since Node 15). ### Details File: src/parseListMLSD.ts ``` const factHandlersByName: {[key: string]: FactHandler} = { "size": parseSize, "sizd": parseSize, "unique": (value, info) => { info.uniqueID = value }, "modify": (value, info) => { ... }, "type": (value, info) => { ... }, "unix.mode": (value, info) => { ... }, ... } export function parseLine(line: string): FileInfo | undefined { const [ packedFacts, name ] = splitStringOnce(line, " ") ... const facts = packedFacts.split(";") for (const fact of facts) { const [ factName, factValue ] = splitStringOnce(fact, "=") if (!factValue) { continue } const factHandler = factHandlersByName[factName.toLowerCase()] // <-- unsafe lookup if (!factHandler) { continue } const result = factHandler(factValue, info) // <-- throws here ... } return info } ``` fact