CVE-2026-116674: systeminformation: Prototype pollution in `networkStats()` via the interface name
systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStats(ifaces) in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the plain-object network cache and indexes it with the sanitized caller-controlled interface name. Passing proto causes the inherited Object.prototype value to be used instead of creating an own cache entry, so calcNetworkSpeed() writes rxbytes, txbytes, rxsec, txsec, ms, lastms, and operstate onto Object.prototype. The polluted property names are fixed and their values come from interface statistics, but inherited-name collisions and enumerable keys can corrupt application branching, serialization, configuration merging, validation, or lookup behavior. This issue is fixed in version 5.33.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
systeminformationto a version that resolves this vulnerability.Fixed in 5.33.13
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using systeminformation before 5.33.13 on FreeBSD, OpenBSD, or NetBSD are affected when they call networkStats(ifaces) with attacker-influenced interface names. The described issue does not identify affected behavior on other operating systems.
What does an attacker need to exploit this?
An attacker needs to influence the interface-name value passed to networkStats(ifaces) so that it is proto. No authentication or user interaction is required according to the provided vector, but exploitation has high attack complexity.
Are the polluted properties fully attacker-controlled?
No. The affected property names are fixed: rx_bytes, tx_bytes, rx_sec, tx_sec, ms, last_ms, and operstate. Their values are derived from interface statistics, although the resulting inherited and enumerable Object.prototype properties can affect application logic and object handling.
What should be done if an immediate upgrade is not possible?
Do not pass untrusted interface names to networkStats(ifaces), and specifically reject proto as an interface-name input. Review code paths that use networkStats results or plain-object operations for inherited-property behavior, serialization, configuration merging, validation, and lookups.
How can I determine whether an application may already be affected?
Check whether the application uses a systeminformation version earlier than 5.33.13 on FreeBSD, OpenBSD, or NetBSD and calls networkStats(ifaces) with externally influenced input. During or after such a call with proto, Object.prototype may contain enumerable rx_bytes, tx_bytes, rx_sec, tx_sec, ms, last_ms, or operstate properties.