deepstream is vulnerable to prototype pollution

CRITICAL 9.9CVE-2026-49252 · GHSA-9v98-6g37-x9g6 · Published 18/06/2026 · updated 26/10/2026

Package	Affected versions	Patched versions
@deepstream/server npm	`< 10.0.5`	`10.0.5`

Description

Impact

Prototype pollution in deepstream server v <=10.0.4. Potential privilege escalation from any authenticated user with write permission to any record.

Patches

Yes, upgrade to v10.0.5

Workarounds

Filter out all messages containing the path __proto__, constructor, prototype, before they reach the server's message pipeline

NVD description

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. Versions prior to 10.0.5 are vulnerable to Prototype Pollution. Exploitation can lead to potential privilege escalation from any authenticated user with write permission to any record. This issue has been fixed in version 10.0.5.

References

deepstreamIO/deepstream.io security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-49252 · ADVISORY
deepstreamIO/deepstream.io commit 54b8e29 · WEB
deepstreamIO/deepstream.io · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free