Skip to content
OpenAdvisories

Package · npm

@deepstream/server

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 8.8
    CVE-2026-63116

    deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes

    deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORD_ACTION.PATCH_MULTI from RULES_MAP. When an authenticated user…

    deepstreamIO deepstream.io @deepstream/server npm
  • Critical 9.9
    CVE-2026-49252

    deepstream is vulnerable to prototype pollution

    deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. Versions prior to 10.0.5 are vulnerable to Prototype Pollution. Exploitation can lead to potential privilege escalation from any authenticated …

    deepstreamIO deepstream.io @deepstream/server npm