{"id":"CVE-2026-49252","title":"deepstream is vulnerable to prototype pollution","summary":"deepstream is vulnerable to prototype pollution","severity":"critical","cvss":9.9,"cwe":["CWE-1321"],"vendor":"deepstream","product":"@deepstream/server","ecosystem":"npm","affected":["@deepstream/server < 10.0.5"],"patched":["@deepstream/server 10.0.5"],"published":"2026-06-26","updated":"2026-06-26","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-9v98-6g37-x9g6","references":[{"url":"https://github.com/deepstreamIO/deepstream.io/security/advisories/GHSA-9v98-6g37-x9g6"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49252"},{"url":"https://github.com/deepstreamIO/deepstream.io/commit/54b8e2958a98df444b5b5d9a66e22872afd84e44"},{"url":"https://github.com/advisories/GHSA-9v98-6g37-x9g6"}],"tags":["ghsa","npm"],"epss":0.0047,"epssPercentile":0.39851,"ingestedAt":"2026-06-29T13:24:35.241Z","slug":"CVE-2026-49252","body":"## Overview\n\n### Impact\nPrototype pollution in deepstream server v <=10.0.4. Potential privilege escalation from any authenticated user with write permission to any record.\n\n### Patches\nYes, upgrade to v10.0.5\n\n### Workarounds\nFilter out all messages containing the path `__proto__`, `constructor`, `prototype`, **before they reach the server's message pipeline**\n\n## Affected packages\n\n- `@deepstream/server < 10.0.5`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `@deepstream/server 10.0.5`","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":54.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}