deepstream is vulnerable to prototype pollution
Description
deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. Versions prior to 10.0.5 are vulnerable to Prototype Pollution. Exploitation can lead to potential privilege escalation from any authenticated user with write permission to any record. This issue has been fixed in version 10.0.5.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <10.0.5
Patches
Vulnerability mechanics
Root cause
"Missing validation of JSON path segments in `json-path.ts` allowed `__proto__`, `constructor`, and `prototype` keys to be used, enabling prototype pollution via record write operations."
Attack vector
An authenticated user with write permission to any record can send a crafted record write message containing a JSON path that includes `__proto__`, `constructor.prototype`, or similar prototype-chain tokens [patch_id=6590930]. The `tokenize` function in `json-path.ts` previously did not reject these keys, so `setValue` would traverse and pollute `Object.prototype`. This prototype pollution can then be leveraged for privilege escalation across the deepstream server.
Affected code
The vulnerability resides in `src/utils/json-path.ts` where the `tokenize` function lacked checks for `__proto__`, `constructor`, and `prototype` keys, and in `src/handlers/record/record-transition.ts` and `src/services/permission/valve/rule-application.ts` which called `setValue` without validating the path. The patch adds a `FORBIDDEN_KEYS` set and an `isValidPath` guard, and wraps `setValue` calls in try-catch blocks.
What the fix does
The patch introduces a `FORBIDDEN_KEYS` set containing `__proto__`, `constructor`, and `prototype` in `json-path.ts`. The `tokenize` function now throws an error when any of these keys appear as a path segment, and a new `isValidPath` function exposes this check. In `record-transition.ts`, incoming messages are validated with `isValidPath` before processing, and in `rule-application.ts`, the `setValue` call is wrapped in a try-catch to safely handle the thrown error. Together these changes prevent any path that could traverse the prototype chain from being used to set values.
Preconditions
- authThe attacker must be an authenticated user of the deepstream server.
- configThe attacker must have write permission to at least one record.
- inputThe attacker sends a record write message with a path containing '__proto__', 'constructor.prototype', or similar forbidden keys.
Generated on Jun 19, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
2- github.com/deepstreamIO/deepstream.io/commit/54b8e2958a98df444b5b5d9a66e22872afd84e44mitrex_refsource_MISC
- github.com/deepstreamIO/deepstream.io/security/advisories/GHSA-9v98-6g37-x9g6mitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.