Executive brief
deepstream is a real-time data synchronization server used to connect clients and backend services. A security flaw allows authenticated users with basic write permissions to manipulate the server's internal configuration. This could lead to a complete takeover of the system, unauthorized access to sensitive data, or disruption of services.
Technical details
A prototype pollution vulnerability (CWE-1321) exists in deepstream server versions up to and including 10.0.4. The vulnerability is triggered when the server processes specially crafted messages containing restricted keys like '__proto__', 'constructor', or 'prototype'. An authenticated attacker with network access and write permissions to any record can exploit this to modify the global object prototype. This can lead to privilege escalation, remote code execution, or denial of service. The issue is fixed in version 10.0.5.
Affected products
- deepstreamIO deepstream.io <= 10.0.4
Timeline
- 2026-05-25: disclosed
- 2026-06-18: advisory: NVD publication date
- 2026-06-26: advisory: GitHub Advisory reviewed