deepstream.io Security Update Addresses 1 Vulnerability
Tech GuruQuick Answer
In @deepstream/server 10.1.0, authenticated users can bypass Valve write rules with PATCH_MULTI. Version 10.1.1 fixes the missing permission mapping. The issue affects deployments using permission.type=config; the default permissive mode already allows writes and is not a secure workaround.
Confirm Scope And Apply The Supported Fix
What to do now: Identify 10.1.0 servers using Valve, update every instance to 10.1.1, and validate record-write restrictions with a deliberately limited test account. Preserve audit data for any suspected unauthorized changes.
Last verified: 2026-09-23 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | deepstream.io packages and release streams identified in the project advisories |
|---|---|
| Advisory | GHSA-89vx-jh4q-vg3w |
| CVE | CVE-2026-63116 |
| Project advisory publication | 2026-06-29 14:04:05 UTC |
| Recorded source timestamp (historical snapshot) | 2026-09-22 19:56:34 UTC |
| Affected versions | @deepstream/server = 10.1.0 |
| Fixed version | @deepstream/server 10.1.1 |
| CVSS base score | 8.8 (CVSS v3) |
| CVSS severity | High |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
The Valve rules map omits PATCH_MULTI, causing its permission lookup to return no rule and allow the operation. A valid low-privilege account can therefore modify records that configured write rules should protect. The project version field names 10.1.0; custom builds containing the same action and missing mapping need separate assessment.
What To Validate Now
- Inventory. Locate deepstream.io packages and release streams identified in the project advisories deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: @deepstream/server = 10.1.0 Do not infer applicability from product family or severity alone.
- Remediate. Apply @deepstream/server 10.1.1 through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Confirm all servers run 10.1.1 and retain the intended Valve configuration. With test records, verify restricted PATCH_MULTI writes are denied and authorized updates still succeed. Check existing data integrity separately; installing the fix does not undo earlier record changes.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Do not change the permission mode to none as a workaround: it intentionally allows operations. Coordinate a multi-instance rollout and keep authentication, write restrictions, backups and record-change evidence intact.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
