deepstream.io, a server for data synchronization, messaging, and RPCs, suffers from a Prototype Pollution vulnerability in versions before 10.0.5. This flaw allows improper modification of object prototype attributes, which can be exploited by any authenticated user with write access to escalate privileges. The vulnerability is tracked as CVE-2026-49252 and has a critical severity rating with a CVSS 3.1 score of 9.9. The issue has been resolved in deepstream.io version 10.0.5.

Exploitation of this vulnerability can lead to privilege escalation from any authenticated user who has write permission to any record, potentially compromising confidentiality, integrity, and availability of the system. The CVSS vector indicates network attack vector, low attack complexity, privileges required, no user interaction, scope changed, and high impact on confidentiality, integrity, and low impact on availability.

Upgrade deepstream.io to version 10.0.5 or later, where this Prototype Pollution vulnerability has been fixed. No other mitigation is specified or required once the update is applied.