Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-49252: Deepstream Server Versions Prior to 10.0.5 Allow Unauthorized Access

CVE-2026-49252 GHSA-9v98-6g37-x9g6

Summary

Versions of the Deepstream server prior to 10.0.5 contain a security flaw that allows an authenticated user with write permission to access and modify sensitive data. This could potentially give the user more privileges than they should have. To fix this issue, update to version 10.0.5 or later.

What to do

Update deepstream server to version 10.0.5.

Affected software

Ecosystem	Vendor	Product	Affected versions
npm	deepstream	server	< 10.0.5 Fix: upgrade to 10.0.5

Original title

deepstream is vulnerable to prototype pollution

Original description

### Impact
Prototype pollution in deepstream server v <=10.0.4. Potential privilege escalation from any authenticated user with write permission to any record.

### Patches
Yes, upgrade to v10.0.5

### Workarounds
Filter out all messages containing the path `__proto__`, `constructor`, `prototype`, **before they reach the server's message pipeline**

nvd CVSS3.1 9.9

Vulnerability type

CWE-1321 Prototype Pollution

Published: 26 Jun 2026 · Updated: 20 Jul 2026 · First seen: 18 Jun 2026