---
id: CVE-2026-49252
title: deepstream is vulnerable to prototype pollution
summary: deepstream is vulnerable to prototype pollution
severity: critical
cvss: 9.9
cwe:
  - CWE-1321
vendor: deepstream
product: '@deepstream/server'
ecosystem: npm
affected:
  - '@deepstream/server < 10.0.5'
patched:
  - '@deepstream/server 10.0.5'
published: '2026-06-26'
updated: '2026-06-26'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-9v98-6g37-x9g6'
references:
  - url: >-
      https://github.com/deepstreamIO/deepstream.io/security/advisories/GHSA-9v98-6g37-x9g6
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-49252'
  - url: >-
      https://github.com/deepstreamIO/deepstream.io/commit/54b8e2958a98df444b5b5d9a66e22872afd84e44
  - url: 'https://github.com/advisories/GHSA-9v98-6g37-x9g6'
tags:
  - ghsa
  - npm
epss: 0.0047
epssPercentile: 0.37956
ingestedAt: '2026-06-29T13:24:35.241Z'
---

## Overview

### Impact
Prototype pollution in deepstream server v <=10.0.4. Potential privilege escalation from any authenticated user with write permission to any record.

### Patches
Yes, upgrade to v10.0.5

### Workarounds
Filter out all messages containing the path `__proto__`, `constructor`, `prototype`, **before they reach the server's message pipeline**

## Affected packages

- `@deepstream/server < 10.0.5`

## Remediation

Upgrade to a patched release:

- `@deepstream/server 10.0.5`