Skip to content
OpenAdvisories

Package · npm

@deepstream/server

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.8
    CVE-2026-63116

    deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes

    deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORD_ACTION.PATCH_MULTI from RULES_MAP. When an authenticated user…

    deepstreamIO deepstream.io @deepstream/server npm