GitHub Advisoryadvisory · npm

GHSA-9v98-6g37-x9g6 deepstream is vulnerable to prototype pollution

CRITICAL Published 2026-06-26 Modified 2026-06-26 Official page ↗
Aliases
CVE-2026-49252
Ecosystem
npm
Packages
@deepstream/server
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Weaknesses
CWE-1321
Reviewed
2026-06-26

Affected packages

• npm @deepstream/server: < 10.0.5 → fixed in 10.0.5

Description

Impact Prototype pollution in deepstream server v <=10.0.4. Potential privilege escalation from any authenticated user with write permission to any record. Patches Yes, upgrade to v10.0.5 Workarounds Filter out all messages containing the path `__proto__`, `constructor`, `prototype`, before they reach the server's message pipeline

Related

Alias · CVE (1)

  • CVE-2026-49252 deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References