UBUNTU-CVE-2026-116674: Medium severity ubuntu/node-systeminformation vulnerability

Published Oct 27, 2026

Updated

systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStats(ifaces) in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the plain-object network cache and indexes it with the sanitized caller-controlled interface name. Passing proto causes the inherited Object.prototype value to be used instead of creating an own cache entry, so calcNetworkSpeed() writes rxbytes, txbytes, rxsec, txsec, ms, lastms, and operstate onto Object.prototype. The polluted property names are fixed and their values come from interface statistics, but inherited-name collisions and enumerable keys can corrupt application branching, serialization, configuration merging, validation, or lookup behavior. This issue is fixed in version 5.33.13.

Affected Software

1 affected component

ubuntu/node-systeminformation*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade systeminformation to a version that resolves this vulnerability.
Fixed in 5.33.13

Event History

Oct 27, 2026

CVE Published

via OSV·05:16 PM

Data Sourced

via OSV·05:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are affected by this issue?

The vulnerable code path is specific to FreeBSD, OpenBSD, and NetBSD. Applications using systeminformation on other operating systems are not identified as affected by the provided data.

What must an attacker be able to do to trigger the pollution?

An attacker must be able to cause the application to call networkStats(ifaces) with a caller-controlled interface name that sanitizes to proto. No authentication or user interaction is required according to the supplied vector, but exploitation has high attack complexity.

What is the practical impact of the Object.prototype pollution?

The issue adds fixed, enumerable network-statistics properties to Object.prototype, including rx_bytes, tx_bytes, rx_sec, tx_sec, ms, last_ms, and operstate. This can affect application logic that relies on inherited-property behavior, serialization, configuration merging, validation, or object lookups.

What should be done if the package cannot be updated immediately?

Prevent untrusted input from reaching the interface-name argument passed to networkStats(ifaces), particularly values that sanitize to proto. Review application behavior that enumerates properties or merges and validates plain objects, since those operations may be affected by polluted inherited properties.

What version contains the fix?

The issue is fixed in systeminformation version 5.33.13. Update affected installations to that version or later.

UBUNTU-CVE-2026-116674: Medium severity ubuntu/node-systeminformation vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected by this issue?

What must an attacker be able to do to trigger the pollution?

What is the practical impact of the Object.prototype pollution?

What should be done if the package cannot be updated immediately?

What version contains the fix?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected by this issue?

What must an attacker be able to do to trigger the pollution?

What is the practical impact of the Object.prototype pollution?

What should be done if the package cannot be updated immediately?

What version contains the fix?