CVE-2026-63116: deepstream Server PATCH_MULTI Action Bypass Vulnerability
Summary
CVE-2026-63116: deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes. Affects @deepstream/server versions >= 10.1.0, < 10.1.1. Fixed in 10.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
deepstream is an open-source server designed for building real-time applications. It provides features such as data synchronization, event handling, and permission management, making it a popular choice for developers looking to create scalable applications. However, a critical vulnerability has been identified in its permission system, specifically related to the PATCH_MULTI action, which allows unauthorized data modifications.
Vulnerability Detail
The vulnerability arises from the absence of the RECORD_ACTION.PATCH_MULTI action in the Valve permission system's RULES_MAP. This oversight allows any authenticated user, regardless of their permissions, to perform arbitrary writes to any record. When the permission check is executed, the system returns null for this action, leading to an unconditional allow response. As a result, attackers can exploit this flaw to overwrite sensitive records, including those restricted to admin users, potentially leading to data corruption, service outages, and unauthorized access to sensitive information.
How To Fix
Latest published version: 10.2.4 as of 23 Oct 2026
npm install @deepstream/server@10.2.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
10.1.1
This is the first release that contains the fix.
npm install @deepstream/server@10.1.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds to mitigate this vulnerability other than updating to the patched version. However, you can temporarily restrict access to the deepstream server until the update is applied.
Conclusion
The deepstream server vulnerability CVE-2026-63116 poses a significant risk by allowing unauthorized record modifications through the PATCH_MULTI action. It is crucial for users to update to the patched version to secure their applications and prevent potential exploitation.
See every vulnerability recorded for @deepstream/server →
FAQ
The vulnerability allows authenticated users to bypass permission checks and modify records using the PATCH_MULTI action.
All users of the deepstream server version 10.1.0 and earlier that utilize the Valve permission system are affected.
Exploitation of this vulnerability can lead to unauthorized data modifications, service outages, and potential data corruption.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application's vulnerability status without signup.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for @deepstream/server.
