deepstreamIO deepstream.io vulnerabilities

Latest deepstreamIO deepstream.io CVEs

Newest publication first

1. CVE-2026-63116 deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes

   Published 2026-09-21

   High·CVSS 8.8 EPSS 0.51%

   deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORD_ACTION.PATCH_MULTI from RULES_MAP. When an authenticated user sends a PATCH_MULTI...

2. CVE-2026-49252 deepstream is vulnerable to prototype pollution

   Published 2026-06-18

   Critical·CVSS 9.9 EPSS 0.47%

   deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. Versions prior to 10.0.5 are vulnerable to Prototype Pollution. Exploitation can lead to potential privilege escalation from any authenticated user with write permi...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.