CVE-2026-49252

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. Versions prior to 10.0.5 are vulnerable to Prototype Pollution. Exploitation can lead to potential privilege escalation from any authenticated user with write permission to any record. This issue has been fixed in version 10.0.5.

CVSS v3 9.9 CRITICAL

9.9^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://github.com/deepstreamIO/deepstream.io/commit/54b8e2958a98df444b5b5d9a66e22872afd84e44
https://github.com/deepstreamIO/deepstream.io/security/advisories/GHSA-9v98-6g37-x9g6

Configurations

No configuration.

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) deepstream es un servidor que permite a los clientes y servicios de backend sincronizar datos, enviar mensajes y realizar RPC a escala. Las versiones anteriores a la 10.0.5 son vulnerables a la Contaminación de Prototipos. Su explotación puede conducir a una potencial escalada de privilegios desde cualquier usuario autenticado con permiso de escritura en cualquier registro. Este problema ha sido solucionado en la versión 10.0.5.

Information

Published : 2026-06-18 21:16

Updated : 2026-10-26 11:10

NVD link : CVE-2026-49252

Mitre link : CVE-2026-49252

CVE.ORG link : CVE-2026-49252

JSON object : View

Products Affected

No product.

CWE

CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

{"id": "CVE-2026-49252", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49252", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-22T15:10:20.891417Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "deepstreamIO", "product": "deepstream.io", "versions": [{"status": "affected", "version": "< 10.0.5"}]}]}], "published": "2026-06-18T21:16:29.643", "references": [{"url": "https://github.com/deepstreamIO/deepstream.io/commit/54b8e2958a98df444b5b5d9a66e22872afd84e44", "source": "security-advisories@github.com"}, {"url": "https://github.com/deepstreamIO/deepstream.io/security/advisories/GHSA-9v98-6g37-x9g6", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1321"}]}], "descriptions": [{"lang": "en", "value": "deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. Versions prior to 10.0.5 are vulnerable to Prototype Pollution. Exploitation can lead to potential privilege escalation from any authenticated user with write permission to any record. This issue has been fixed in version 10.0.5."}, {"lang": "es", "value": "deepstream es un servidor que permite a los clientes y servicios de backend sincronizar datos, enviar mensajes y realizar RPC a escala. Las versiones anteriores a la 10.0.5 son vulnerables a la Contaminaci\u00f3n de Prototipos. Su explotaci\u00f3n puede conducir a una potencial escalada de privilegios desde cualquier usuario autenticado con permiso de escritura en cualquier registro. Este problema ha sido solucionado en la versi\u00f3n 10.0.5."}], "lastModified": "2026-10-26T11:10:00.157", "sourceIdentifier": "security-advisories@github.com"}