npm/@deepstream/server CVE-2026-63116: high 8.8, EPSS 0.51%

deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes

Action: Upgrade @deepstream/server to 10.1.1 or later.

npm i @deepstream/server@10.1.1

Affected

Fixed versions

Sources

• osv: GHSA-89vx-jh4q-vg3w
• https://github.com/deepstreamIO/deepstream.io/security/advisories/GHSA-89vx-jh4q-vg3w
• https://nvd.nist.gov/vuln/detail/CVE-2026-63116
• https://github.com/deepstreamIO/deepstream.io/commit/1c2adde6581c53ef47e204364bc740bc3c2e2e2a
• https://github.com/deepstreamIO/deepstream.io
• https://github.com/deepstreamIO/deepstream.io/releases/tag/v10.1.1

CVE-2026-63116 · published 2026-09-22T19:56:34Z · modified 2026-09-22T20:15:05.103023001Z · JSON