Read the docs
TI-2026-45058 Aliases CVE-2026-63116GHSA-89vx-jh4q-vg3w

deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes

Priority HIGH 73CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORD_ACTION.PATCH_MULTI from RULES_MAP. When an authenticated user sends a PATCH_MULTI record operation while permission.type is config, getRulesForMessage returns a null rule specification and ConfigPermission.canPerformAction treats the missing specification as an unconditional allow instead of applying RULE_TYPES.WRITE. Any authenticated user can therefore modify arbitrary protected records, corrupt application state, or cause service disruption; deployments using the default permission type none already allow all operations and are not additionally affected. This issue is fixed in version 10.1.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00506 43rd percentileScored 2026-11-07
Fix Fixed deepstream.io (deepstreamIO): 10.1.1@deepstream/server (npm): 10.1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
deepstreamIOdeepstream.io10.1.0 to before 10.1.110.1.1Patch availableCNA
—@deepstream/server (npm)10.1.0 to before 10.1.110.1.1Patch availableGHSA-89vx-jh4q-vg3w
  • deepstream.io VendordeepstreamIO Affected 10.1.0 to before 10.1.1 Fixed in 10.1.1 Patch available CNA
  • @deepstream/server (npm) Vendor— Affected 10.1.0 to before 10.1.1 Fixed in 10.1.1 Patch available GHSA-89vx-jh4q-vg3w

Remediation

  • Fix · CNA deepstream.io (deepstreamIO) Fixed in 10.1.1
  • Fix · GHSA-89vx-jh4q-vg3w @deepstream/server (npm) Fixed in 10.1.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-63116
  2. 2026-10-03 Alias added: GHSA-89vx-jh4q-vg3w

References

Advisory 1

Other 4

  • TI-2026-36448 deepstream is vulnerable to prototype pollution CVSS 3.1CRITICAL 9.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences