CVE-2026-49252

Summary

deepstream is vulnerable to prototype pollution

Severity

critical

CVSS

9.9

EPSS

0.5% (p39)

CWE

CWE-1321

Also known as

GHSA-9v98-6g37-x9g6

Published

2026-06-26

Updated

2026-06-26

Advisory details

Impact

Prototype pollution in deepstream server v <=10.0.4. Potential privilege escalation from any authenticated user with write permission to any record.

Patches

Yes, upgrade to v10.0.5

Workarounds

Filter out all messages containing the path __proto__, constructor, prototype, before they reach the server's message pipeline

References

• https://github.com/advisories/GHSA-9v98-6g37-x9g6
• https://github.com/deepstreamIO/deepstream.io/security/advisories/GHSA-9v98-6g37-x9g6
• https://nvd.nist.gov/vuln/detail/CVE-2026-49252
• https://github.com/deepstreamIO/deepstream.io/commit/54b8e2958a98df444b5b5d9a66e22872afd84e44

Related advisories

• CVE-2026-53609 — critical · npm/apostrophe
• CVE-2026-48713 — critical · npm/i18next-fs-backend
• CVE-2026-48714 — critical · npm/i18next-http-middleware
• CVE-2019-10744 — critical · npm/lodash
• CVE-2026-63376 — high · npm/toml
• CVE-2026-82404 — high · npm/@toon-format/toon
• CVE-2026-71553 — high · npm/apostrophe
• CVE-2026-73088 — high · npm/browserslist

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity