Junglewise Threat Intelligence

CVE-2026-49252: deepstreamIO deepstream.io prototype pollution privilege escalation

CVE-2026-49252 · Severity: critical · CVSS 9.9 · Published 2026-06-18

Executive brief

deepstream is a real-time data synchronization server used to connect clients and backend services. A security flaw allows authenticated users with basic write permissions to manipulate the server's internal configuration. This could lead to a complete takeover of the system, unauthorized access to sensitive data, or disruption of services.

Technical details

A prototype pollution vulnerability (CWE-1321) exists in deepstream server versions up to and including 10.0.4. The vulnerability is triggered when the server processes specially crafted messages containing restricted keys like '__proto__', 'constructor', or 'prototype'. An authenticated attacker with network access and write permissions to any record can exploit this to modify the global object prototype. This can lead to privilege escalation, remote code execution, or denial of service. The issue is fixed in version 10.0.5.

Affected products

  • deepstreamIO deepstream.io <= 10.0.4

Timeline

  • 2026-05-25: disclosed
  • 2026-06-18: advisory: NVD publication date
  • 2026-06-26: advisory: GitHub Advisory reviewed

References

Related threats