GHSA-9v98-6g37-x9g6
deepstream is vulnerable to prototype pollution
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @deepstream/server | < 10.0.5 | 10.0.5 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Prototype pollution in deepstream server v <=10.0.4. Potential privilege escalation from any authenticated user with write permission to any record.
### Patches
Yes, upgrade to v10.0.5
### Workarounds
Filter out all messages containing the path `__proto__`, `constructor`, `prototype`, **before they reach the server's message pipeline**
References
External links from the advisory. They lead to third-party sites.