{"action":"Upgrade @deepstream/server to 10.1.1 or later.","affected":[{"fixed":"10.1.1","introduced":"10.1.0"}],"component":"@deepstream/server","cve_ids":["CVE-2026-63116"],"ecosystem":"npm","epss":0.00506,"exploited":false,"fixed_versions":["10.1.1"],"ghsa_id":"GHSA-89vx-jh4q-vg3w","id":"tcs_01M5KFCH35DKFPRQJ5N2VSECDW","modified_at":"2026-09-22T20:15:05.103023001Z","published_at":"2026-09-22T19:56:34Z","references":["https://osv.dev/vulnerability/GHSA-89vx-jh4q-vg3w","https://github.com/deepstreamIO/deepstream.io/security/advisories/GHSA-89vx-jh4q-vg3w","https://nvd.nist.gov/vuln/detail/CVE-2026-63116","https://github.com/deepstreamIO/deepstream.io/commit/1c2adde6581c53ef47e204364bc740bc3c2e2e2a","https://github.com/deepstreamIO/deepstream.io","https://github.com/deepstreamIO/deepstream.io/releases/tag/v10.1.1"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-89vx-jh4q-vg3w","url":"https://osv.dev/vulnerability/GHSA-89vx-jh4q-vg3w"}],"summary":"deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes"}