A prototype pollution flaw exists in the networkStats() function of the systeminformation library for node.js. The function stores per‑interface data in an internal cache keyed by a sanitized interface name. When the special value "proto" is passed, the code falls back to using Object.prototype instead of creating a new cache entry, causing network statistics fields to be written onto the global prototype. This unexpected modification can alter application control flow, validation, configuration merging, and serialization behavior in any code that later accesses enumerated object properties. The weakness is classified as CWE‑1321.

Affected components are the systeminformation package published by sebhildebrandt. Versions prior to 5.33.13 running on FreeBSD, OpenBSD, and NetBSD are impacted. The fix is delivered in release 5.33.13.

The CVSS score of 6.5 indicates medium severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a local attacker with the ability to execute JavaScript code within the node.js process and to call networkStats() with the interface name "proto". Because the pollution occurs at the global JavaScript prototype level, the impact can be wide‑ranging in the affected application but does not provide remote code execution directly. The risk is moderate, especially for applications that rely on untrusted input to determine interface names.