Prototype Pollution Vulnerability in Deepstream by deepstreamIO
CVE-2026-49252

9.9CRITICAL

Key Information:

Vendor

Deepstreamio

Status
Deepstream.io
Vendor
CVE Published:
18 June 2026

What is CVE-2026-49252?

Deepstream, a robust server solution that facilitates synchronization of data and messaging between clients and backend services, has a vulnerability that allows for prototype pollution. This flaw can be exploited by any authenticated user who has write permissions to records, potentially leading to unauthorized privilege escalation. Users are strongly advised to upgrade to version 10.0.5, where this issue has been addressed and resolved.

Affected Version(s)

deepstream.io < 10.0.5

References

https://github.com/deepstreamIO/deepstream.io/security/ad...
x_refsource_CONFIRM
https://github.com/deepstreamIO/deepstream.io/commit/54b8...
x_refsource_MISC

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.