deepstream.io CVE-2026-49252

Requires an authenticated deepstream.io client session (PR:L in the vendor vector) that holds write permission to at least one record under the server's Valve permission rules, network reachability to the deepstream server's client port, and a server running a version prior to 10.0.5 with the default json-path utility - no user interaction, no admin role, and no non-default feature flag is needed. Exploitation is limited where Valve rules deny write to all records for the attacker's identity, where the deployment fronts deepstream with a proxy that filters record-update payloads for prototype tokens, or where the server has already been restarted onto 10.0.5+; the attack is in-process to Node.js, so multi-process/clustered deployments must have every worker patched to be safe.

Vendor CVSS 3.1 of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L) reflects a network-reachable, low-complexity attack from any authenticated record-writer, with scope change because polluting Object.prototype reaches code outside the record subsystem (notably the permission valve seen in the diff) - a credible justification for S:C rather than CVSS inflation. No EPSS, KEV, or SSVC data was supplied, and CISA KEV does not list this CVE, so the operative signals are the publicly visible patch commit plus regression tests that effectively spell out the vulnerable inputs (__proto__.polluted, constructor.prototype.polluted), which materially lowers the barrier to weaponisation even though no standalone PoC was published. The main limiter is the PR:L precondition: an attacker needs a valid client session with write permission to at least one record, which on hardened deployments (strict Valve rules, anonymous writes disabled) is non-trivial, but on default or permissive deployments - common for collaboration/sync apps - is the normal user role, so this should be treated as a high-priority patch rather than a theoretical issue.

An attacker logs in as a normal deepstream client with write access to even one record (the default for many collaborative-app deployments) and sends a record-update message such as record set with path '__proto__.isAdmin' and value true. The unsafe setValue walks through Object.prototype, so every subsequent object - including data evaluated by the Valve permission engine on later requests - inherits isAdmin=true, allowing the attacker to bypass per-record access controls and escalate privileges across the entire deepstream cluster until the process is restarted.