PT-2026-50790 · Deepstreamio · Deepstream.Io

Published 2026-06-18 · Updated 2026-06-18 · CVE-2026-49252

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions deepstream versions prior to 10.0.5

Description A Prototype Pollution issue exists in the server, which allows clients and backend services to synchronize data, send messages, and make remote procedure calls (RPCs) at scale. Prototype Pollution occurs when an attacker can manipulate the prototype of an object, potentially altering the behavior of the application. This can lead to privilege escalation for any authenticated user who possesses write permissions to any record.

Recommendations Update to version 10.0.5.

Fix

LPE

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2026-49252

Affected Products

Deepstream.Io

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-49252 · Security Note
• https://github.com/deepstreamIO/deepstream.io/commit/54b8e2958a98df444b5b5d9a66e22872afd84e44 · Note
• https://github.com/deepstreamIO/deepstream.io/security/advisories/GHSA-9v98-6g37-x9g6 · Note
• https://twitter.com/VulmonFeeds/status/2067732443134570698 · Twitter Post