Critical severity9.9NVD Advisory· Published Jun 18, 2026· Updated Jun 23, 2026

CVE-2026-49252

Description

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. Versions prior to 10.0.5 are vulnerable to Prototype Pollution. Exploitation can lead to potential privilege escalation from any authenticated user with write permission to any record. This issue has been fixed in version 10.0.5.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
@deepstream/servernpm	< 10.0.5	10.0.5

Affected products

DeepstreamIO/deepstream.iollm-fuzzy
Range: <10.0.5

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-9v98-6g37-x9g6ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-49252ghsaADVISORY
github.com/deepstreamIO/deepstream.io/commit/54b8e2958a98df444b5b5d9a66e22872afd84e44nvdWEB
github.com/deepstreamIO/deepstream.io/security/advisories/GHSA-9v98-6g37-x9g6nvdWEB

News mentions

No linked articles in our index yet.

cvss	0.643
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000