CVE-2026-49252
CVE-2026-49252 · deepstream is vulnerable to prototype pollution
This page contains facts from public vulnerability sources. Check the original advisory before updating.
deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. Versions prior to 10.0.5 are vulnerable to Prototype Pollution. Exploitation can lead to potential privilege escalation from any authenticated user with write permission to any record. This issue has been fixed in version 10.0.5.
CVSS 9.9 · Critical · EPSS 0.5% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
deepstream.io
- Versions
- < 10.0.5: Affected
No fix published
@deepstream/server npm
- Affected ranges
- SEMVER: < 10.0.5
Update to 10.0.5