CVE-2026-49252CWE-1321

deepstream is vulnerable to prototype pollution

Critical · published June 18, 2026

CVSS v3.1
9.9
EPSS
0%
Percentile
39.7
In the wild
Unconfirmed
What it is

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. Versions prior to 10.0.5 are vulnerable to Prototype Pollution. Exploitation can lead to potential privilege escalation from any authenticated user with write permission to any record. This issue has been fixed in version 10.0.5.

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00470 · 39.7th percentile
Weakness
CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Published
2026-06-18T20:01Z
EPSS history
Timeline
  • 18 JUN 20:01Z
    deepstream is vulnerable to prototype pollution
    cvelistv5