CVE-2026-116674 Details
Description
systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStats(ifaces) in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the plain-object _network cache and indexes it with the sanitized caller-controlled interface name. Passing proto causes the inherited Object.prototype value to be used instead of creating an own cache entry, so calcNetworkSpeed() writes rx_bytes, tx_bytes, rx_sec, tx_sec, ms, last_ms, and operstate onto Object.prototype. The polluted property names are fixed and their values come from interface statistics, but inherited-name collisions and enumerable keys can corrupt application branching, serialization, configuration merging, validation, or lookup behavior. This issue is fixed in version 5.33.13.
A prototype pollution vulnerability has been identified in the systeminformation library for Node.js, specifically in versions prior to 5.33.13. The issue arises in the networkStats function within lib/network.js, affecting FreeBSD, OpenBSD, and NetBSD. The vulnerability allows per-interface data to be stored in a plain-object cache, indexed by the caller-controlled interface name. This flaw can be exploited by passing certain names, such as '__proto__', which leads to the injection of interface statistics into Object.prototype. As a result, the polluted properties can disrupt application logic, serialization processes, configuration management, and validation routines.
Users are advised to upgrade to systeminformation version 5.33.13 or later, where this vulnerability has been patched. For those unable to upgrade immediately, a temporary workaround is to validate interface names before use, ensuring that only trusted names are passed to the networkStats function.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-7648-jmwf-vw7j | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/sebhildebrandt/systeminformation/commit/6ff25a1ebc0b1fdc7a8aa3507e46f22007da2969 | [email protected] | Source CodeVendor |
| https://github.com/sebhildebrandt/systeminformation/releases/tag/v5.33.13 | [email protected] | Release NotesVendor |
| https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-7648-jmwf-vw7j | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| systeminformation | <= 5.33.12 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | [email protected] |