deepstream is vulnerable to prototype pollution

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-49252 · Microsoft / collected KEV context

EUVD-2026-37943

GHSA-9v98-6g37-x9g6

cve-program · CVE-2026-49252

• https://github.com/deepstreamIO/deepstream.io/security/advisories/GHSA-9v98-6g37-x9g6
• https://github.com/deepstreamIO/deepstream.io/commit/54b8e2958a98df444b5b5d9a66e22872afd84e44

euvd · EUVD-2026-37943

• https://github.com/deepstreamIO/deepstream.io/security/advisories/GHSA-9v98-6g37-x9g6
• https://github.com/deepstreamIO/deepstream.io/commit/54b8e2958a98df444b5b5d9a66e22872afd84e44

nvd · CVE-2026-49252

• https://github.com/deepstreamIO/deepstream.io/commit/54b8e2958a98df444b5b5d9a66e22872afd84e44
• https://github.com/deepstreamIO/deepstream.io/security/advisories/GHSA-9v98-6g37-x9g6

osv · GHSA-9v98-6g37-x9g6

• https://github.com/deepstreamIO/deepstream.io/security/advisories/GHSA-9v98-6g37-x9g6
• https://nvd.nist.gov/vuln/detail/CVE-2026-49252
• https://github.com/deepstreamIO/deepstream.io/commit/54b8e2958a98df444b5b5d9a66e22872afd84e44
• https://github.com/deepstreamIO/deepstream.io

No related operational record is retained in the current change model.