Cloudanix VulnDB

CVE-2026-116674

Medium · 6.5

CVSS

6.5

EPSS

0.3%

Published

Oct 27, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in a system-information tool for Node.js programs lets specially crafted network requests quietly change how the rest of the program behaves, and updating the tool stops the problem.

Chainable
Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
High
Impact
Data Tampering
Component
Library
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Prototype pollution in networkStats(ifaces) on BSD systems allows caller-controlled interface name 'proto' to write fixed statistics properties (rx_bytes, tx_bytes, rx_sec, tx_sec, ms, last_ms, operstate) directly onto Object.prototype instead of a local cache entry.

Why it matters to the business

Applications using the library on affected BSD platforms may experience corrupted configuration merging, validation failures, broken branching logic, or unexpected serialization behavior, potentially leading to service instability or bypassed security checks.

How an attack unfolds

An attacker supplies the string 'proto' (or a similarly colliding name) as an interface argument to networkStats. The sanitized name indexes into the shared _network cache, causing calcNetworkSpeed to assign attacker-influenced interface statistics onto Object.prototype. Subsequent property lookups in the application inherit these values, altering control flow or data handling.

How to fix it

Upgrade systeminformation to version 5.33.13 or later. If immediate upgrade is not possible, avoid calling networkStats with untrusted interface names on BSD systems and consider process isolation for the library.

How to confirm the fix worked

Confirm installed version is at least 5.33.13 via package manager or require.resolve. Test by calling networkStats(['proto']) and verifying that Object.prototype no longer contains the rx_bytes/tx_bytes properties afterward.

Typical attack path

  1. Identify Node.js application using systeminformation < 5.33.13 on FreeBSD/OpenBSD/NetBSD
  2. Invoke networkStats with interface name 'proto'
  3. Trigger calcNetworkSpeed to pollute Object.prototype with statistics values
  4. Force application code paths that enumerate or access the polluted keys
  5. Observe or abuse resulting logic corruption or configuration changes

How to detect it

Monitor application logs for unexpected inherited properties on plain objects after network interface queries; inspect heap snapshots or use Object.hasOwn checks around configuration and validation logic for the fixed property names rx_bytes, tx_bytes, rx_sec, tx_sec, ms, last_ms, and operstate.

What your security team should do

  • Immediately upgrade all instances of systeminformation to 5.33.13
  • Scan dependency trees for transitive use of the library
  • Add runtime prototype-pollution guards if upgrade timeline exceeds 7 days
  • Review application code that merges or validates objects sourced from external data

The record

systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStats(ifaces) in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the plain-object _network cache and indexes it with the sanitized caller-controlled interface name. Passing proto causes the inherited Object.prototype value to be used instead of creating an own cache entry, so calcNetworkSpeed() writes rx_bytes, tx_bytes, rx_sec, tx_sec, ms, last_ms, and operstate onto Object.prototype. The polluted property names are fixed and their values come from interface statistics, but inherited-name collisions and enumerable keys can corrupt application branching, serialization, configuration merging, validation, or lookup behavior. This issue is fixed in version 5.33.13.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities