deepstream is vulnerable to prototype pollution

GHSA-9v98-6g37-x9g6 · CVE-2026-49252

Published Jun 26, 2026 · Modified Sep 10, 2026

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

Impact

Prototype pollution in deepstream server v <=10.0.4. Potential privilege escalation from any authenticated user with write permission to any record.

Patches

Yes, upgrade to v10.0.5

Workarounds

Filter out all messages containing the path __proto__, constructor, prototype, before they reach the server's message pipeline

References

WEB https://github.com/deepstreamIO/deepstream.io/security/advisories/GHSA-9v98-6g37-x9g6
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-49252
WEB https://github.com/deepstreamIO/deepstream.io/commit/54b8e2958a98df444b5b5d9a66e22872afd84e44
PACKAGE https://github.com/deepstreamIO/deepstream.io

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes