Open-source package vulnerability · npm

CVE-2026-49252: deepstream is vulnerable to prototype pollution

criticalCVSS 3.1 9.9GHSA-9v98-6g37-x9g6

Impact Prototype pollution in deepstream server v <=10.0.4. Potential privilege escalation from any authenticated user with write permission to any record. Patches Yes, upgrade to v10.0.5 Workarounds Filter out all messages containing the path proto, constructor, prototype, before they reach the server's message pipeline

Published Jun 26, 2026

Affected packages

@deepstream/server

Ecosystem: npm
Affected: < 10.0.5
Fixed in: 10.0.5
Check: npm ls @deepstream/server

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Impact

Prototype pollution in deepstream server v <=10.0.4. Potential privilege escalation from any authenticated user with write permission to any record.

Patches

Yes, upgrade to v10.0.5

Workarounds

Filter out all messages containing the path __proto__, constructor, prototype, before they reach the server's message pipeline

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology