{"id":"GHSA-9v98-6g37-x9g6","revision":"b0755a431565450d88659abbd5578d3f","records":[{"revision":"b0755a431565450d88659abbd5578d3f","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-9v98-6g37-x9g6","aliases":["CVE-2026-49252"],"title":"deepstream is vulnerable to prototype pollution","description":"### Impact\nPrototype pollution in deepstream server v <=10.0.4. Potential privilege escalation from any authenticated user with write permission to any record.\n\n### Patches\nYes, upgrade to v10.0.5\n\n### Workarounds\nFilter out all messages containing the path `__proto__`, `constructor`, `prototype`, **before they reach the server's message pipeline**","state":0,"publishedAt":"2026-06-26T21:03:59+00:00","modifiedAt":"2026-09-10T03:50:55.3810712+00:00","affected":[{"ecosystem":"npm","name":"@deepstream/server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"10.0.5"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/deepstreamIO/deepstream.io/security/advisories/GHSA-9v98-6g37-x9g6","https://nvd.nist.gov/vuln/detail/CVE-2026-49252","https://github.com/deepstreamIO/deepstream.io/commit/54b8e2958a98df444b5b5d9a66e22872afd84e44","https://github.com/deepstreamIO/deepstream.io"],"sourceUrl":"https://github.com/advisories/GHSA-9v98-6g37-x9g6","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-9v98-6g37-x9g6","identifiers":["GHSA-9v98-6g37-x9g6","CVE-2026-49252"]},"retained":false,"historicalAffected":[]}],"coverage":[]}