Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@deepstream/server

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.8npmAmendedPublished

    deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes

    CVE-2026-63116 · GHSA-89vx-jh4q-vg3w

    Affected
    • npm @deepstream/server >= 10.1.0, <= 10.1.0
    Fixed in
    10.1.1· Vendor fix available
    Issue
    The RECORDACTION.PATCHMULTI action is not registered in the Valve permission system's RULESMAP (src/services/permission/valve/rules-map.ts). When ConfigPermission.canPerformAction() is called for a PATCHMULTI message, getRulesForMessage() returns null because the action is missing from the map. This triggers an unconditional allow (callback(..., null, true)), completely bypassing all configured Valve permission rules. Any authenticated user — regardless of their configured permissions — can write arbitrary data to any record using the PATCHMULTI action. Root Cause In src/services/permission/valve/rules-map.ts lines 38-54, the RULESMAP[TOPIC.RECORD].actions dictionary maps record actions to permission rule types. The actions registered include: SUBSCRIBE, SUBSCRIBEANDHEAD, SUBSCRIBEANDREAD, READ, HEAD, LISTEN, CREATE, UPDATE, PATCH, NOTIFY, DELETE, ERASE. However, RECORDACTION.PATCHMULTI is absent from this map. When getRulesForMessage() at line 86-99 encounters an action not…

    Recommended action: Upgrade to 10.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →
  2. Critical, CVSS 9.9npmAmendedPublished

    deepstream is vulnerable to prototype pollution

    CVE-2026-49252 · GHSA-9v98-6g37-x9g6

    Affected
    • npm @deepstream/server < 10.0.5
    Fixed in
    10.0.5· Vendor fix available
    Issue
    Impact Prototype pollution in deepstream server v <=10.0.4. Potential privilege escalation from any authenticated user with write permission to any record. Patches Yes, upgrade to v10.0.5 Workarounds Filter out all messages containing the path proto, constructor, prototype, before they reach the server's message pipeline

    Recommended action: Upgrade to 10.0.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →