CVE-2026-63116: deepstream Auth Bypass Vulnerability

CVE-2026-63116 Overview

deepstream.io is a realtime server that synchronizes data, delivers messages, and executes remote procedure calls (RPCs) between clients and backend services. CVE-2026-63116 is a missing authorization flaw [CWE-862] affecting deepstream.io versions 10.1.0 through 10.1.0. The src/services/permission/valve/rules-map.ts file omits the RECORD_ACTION.PATCH_MULTI action from the RULES_MAP. When permission.type is set to config, this omission causes ConfigPermission.canPerformAction to treat the missing rule as an unconditional allow. Any authenticated user can modify arbitrary protected records. The issue is fixed in version 10.1.1.

Critical Impact
Authenticated deepstream.io users can bypass configured write permissions via PATCH_MULTI operations to corrupt protected records, tamper with application state, or disrupt service availability.

Affected Products

deepstream.io version 10.1.0
Deployments using permission.type set to config
Deployments with default permission.type of none are not additionally affected (they already allow all operations)

Discovery Timeline

2026-09-21 - CVE-2026-63116 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-63116

Vulnerability Analysis

The vulnerability resides in the permission valve component that maps record actions to rule types. The RULES_MAP object in src/services/permission/valve/rules-map.ts maps record operations such as CREATE, UPDATE, PATCH, DELETE, and ERASE to their required rule types. The PATCH_MULTI operation, which applies multiple field updates to a record in a single message, is absent from this mapping.

When an authenticated client sends a PATCH_MULTI message and the deployment uses permission.type: config, the getRulesForMessage function returns a null rule specification. The ConfigPermission.canPerformAction handler interprets the missing specification as an unconditional allow rather than falling through to RULE_TYPES.WRITE. This effectively skips permission evaluation for multi-field patch operations, granting write access to any record regardless of configured rules.

Root Cause

The root cause is an incomplete authorization mapping. The permission engine relies on the RULES_MAP lookup to determine which rule category governs each record action. Missing entries default to permit rather than deny, which violates fail-secure design principles.

Attack Vector

An authenticated user with a valid deepstream connection sends a PATCH_MULTI record message targeting any record protected by a WRITE rule. Because the permission engine returns no rule specification, the operation proceeds regardless of the intended access policy. The attacker can overwrite fields in records they should not be able to modify, causing data corruption or targeted denial of service against dependent clients.

typescript

       [RECORD_ACTION.CREATE]: RULE_TYPES.CREATE,
       [RECORD_ACTION.UPDATE]: RULE_TYPES.WRITE,
       [RECORD_ACTION.PATCH]: RULE_TYPES.WRITE,
+      [RECORD_ACTION.PATCH_MULTI]: RULE_TYPES.WRITE,
       [RECORD_ACTION.NOTIFY]: RULE_TYPES.NOTIFY,
       [RECORD_ACTION.DELETE]: RULE_TYPES.DELETE,
       [RECORD_ACTION.ERASE]: RULE_TYPES.DELETE

Source: GitHub Commit 1c2adde — the patch adds PATCH_MULTI to the RULES_MAP so that multi-field patch operations are evaluated under RULE_TYPES.WRITE.

Detection Methods for CVE-2026-63116

Indicators of Compromise

Unexpected PATCH_MULTI record actions in deepstream server logs originating from user accounts that lack WRITE permissions on the targeted records.
Unexplained field-level modifications to protected records that do not match any authorized client workflow.
Client applications reporting stale, corrupted, or inconsistent state changes on records subject to config-based permission rules.

Detection Strategies

Enable deepstream permission auditing and log every PATCH_MULTI message with the authenticated user identifier and target record name.
Correlate record write events against the authorization policy defined in the config permission ruleset to flag operations that should have been denied.
Compare deployed deepstream.io versions against the fixed release v10.1.1 to identify affected servers.

Monitoring Recommendations

Ingest deepstream.io application logs into a centralized analytics platform and alert on anomalous PATCH_MULTI volume per user.
Baseline normal record modification patterns for each authenticated principal and alert on deviation.
Track network connections to deepstream endpoints from unexpected source addresses or service accounts.

How to Mitigate CVE-2026-63116

Immediate Actions Required

Upgrade deepstream.io to version 10.1.1 or later, which adds PATCH_MULTI to the RULES_MAP.
Audit existing records for unauthorized field modifications performed since deploying version 10.1.0.
Rotate authentication credentials for any user accounts that may have been used to abuse the vulnerable code path.

Patch Information

The fix is available in deepstream.io v10.1.1. The corresponding source change is documented in GitHub Commit 1c2adde and detailed in GitHub Security Advisory GHSA-89vx-jh4q-vg3w.

Workarounds

Restrict deepstream.io authentication to trusted principals until the upgrade to 10.1.1 is complete.
If configuration permits, block or filter PATCH_MULTI record actions at an upstream proxy for deployments using permission.type: config.
Enforce stricter user provisioning to minimize the number of accounts capable of connecting to affected deepstream servers.

bash

# Upgrade deepstream.io to the patched release
npm install deepstream.io@10.1.1

# Verify the installed version
npx deepstream --version