Object Prototype Pollution in systeminformation on FreeBSD, OpenBSD, and NetBSD

CVE-2026-116674

What is CVE-2026-116674?

The systeminformation library for node.js is susceptible to Object Prototype Pollution, affecting users on FreeBSD, OpenBSD, and NetBSD. Prior to version 5.33.13, the library mishandles per-interface network data by storing it in a plain-object cache that can be influenced by caller-controlled input. This vulnerability allows an attacker to manipulate inherited properties, potentially corrupting application logic, serialization processes, configuration management, and validation mechanisms. The issue has been addressed in version 5.33.13, highlighting the importance of updating to secure systems against this risk.

References