CVE-2026-49252: deepstream is vulnerable to prototype pollution

Synopsis

Prototype pollution in deepstream.io allows any authenticated user with record-write permission to corrupt JavaScript object prototypes on the server. The vulnerability is reachable over the network and requires only a low-privilege account, so no admin access is needed to exploit it. Successful exploitation enables privilege escalation, full read and write access to server data, and partial disruption of availability. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is confirmed published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the deepstream server over the network; the service exposes a remotely accessible endpoint that accepts client connections.

• AuthenticationRequired

  Any low-privilege account with record-write permission is sufficient; no admin or elevated credentials are needed.

• Victim interactionNot required

  No user interaction is required; the attacker acts entirely on their own without needing to trick another party.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory layout knowledge, or environmental prerequisites.

Blast Radius

• Attacker escalates from a low-privilege account to broader server-side privileges by corrupting shared JavaScript object prototypes.
• Attacker reads confidential records and data synced between clients and backend services, including any stored session or application state.
• Attacker modifies persisted records and data across the deepstream server, affecting all clients and backend services sharing that state.
• Attacker degrades service reliability; availability impact is rated low, meaning partial disruption or instability of the deepstream process is achievable.