CVE-2026-116674 systeminformation: Prototype pollution in `networkStats()` via the interface name
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-116674?
CVE-2026-116674 is a medium-severity vulnerability in sebhildebrandt systeminformation, published on 27 Oct 2026.
Official description
systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStats(ifaces) in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the plain-object _network cache and indexes it with the sanitized caller-controlled interface name. Passing proto causes the inherited Object.prototype value to be used instead of creating an own cache entry, so calcNetworkSpeed() writes rx_bytes, tx_bytes, rx_sec, tx_sec, ms, last_ms, and operstate onto Object.prototype. The polluted property names are fixed and their values come from interface statistics, but inherited-name collisions and enumerable keys can corrupt application branching, serialization, configuration merging, validation, or lookup behavior. This issue is fixed in version 5.33.13.
Weakness: CWE-1321
Which versions are affected by CVE-2026-116674?
2 open source packages ship an affected version, including systeminformation.
| Package | Affected | Fixed in |
|---|---|---|
systeminformation npm | All versions | 5.33.13 |
systeminformation npm | All versions | 5.33.13 |
How do I fix CVE-2026-116674?
Upgrade systeminformation to 5.33.13 or later.
Is CVE-2026-116674 being exploited?
There is no known exploitation of CVE-2026-116674 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-116674, ECHO-4aaa-1d80-7521, GHSA-7648-jmwf-vw7j, UBUNTU-CVE-2026-116674.