How many CVEs have a located fix in RocketChat/Rocket.Chat?

24 published CVEs have a fix traced to functions in RocketChat/Rocket.Chat, touching 53 functions across 85 files.

Which function in RocketChat/Rocket.Chat has been patched by the most CVEs?

updateOTRAck in apps/meteor/app/otr/server/methods/updateOTRAck.ts has been changed by 3 CVE fixes, from 2024 to 2024.

How large is a typical CVE fix in RocketChat/Rocket.Chat?

The median fix changes 35 lines. 29% of fixes change 20 lines or fewer, and 17% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

typescript

javascript

#209 of 500 repositories

RocketChat/Rocket.Chat

Name: RocketChat/Rocket.Chat: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix August 21, 2026

24

CVE fixes located

Published CVEs

53

Functions patched

Distinct function sites

85

Files patched

Distinct source files

2018–2026

Years covered

By CVE publication date

Overview

24 published CVEs have a fix traced to functions in RocketChat/Rocket.Chat, the earliest published in 2018. Those fixes changed 53 distinct functions across 85 files, in 292 patch hunks.

Among the 500 repositories tracked here, RocketChat/Rocket.Chat ranks #209 by the number of CVEs with a located fix.

Most patched functions

Functions in RocketChat/Rocket.Chat changed by the most CVE fixes.

Most patched files

Files in RocketChat/Rocket.Chat changed by the most CVE fixes.

1apps/meteor/app/otr/server/methods/updateOTRAck.ts3 CVEs · 2 functions
2apps/meteor/client/views/marketplace/AppDetailsPage/tabs/AppDetails/AppDetails.tsx3 CVEs · 1 functions
3apps/meteor/client/views/marketplace/AppDetailsPage/tabs/AppReleases/AppReleasesItem.tsx3 CVEs · 1 functions
4apps/meteor/server/models/raw/Rooms.ts3 CVEs · 1 functions
5packages/model-typings/src/models/IRoomsModel.ts3 CVEs · 1 functions
6apps/meteor/app/authorization/server/functions/canDeleteMessage.ts3 CVEs · 0 functions
7apps/meteor/client/views/marketplace/lib/purifyOptions.ts3 CVEs · 0 functions
8packages/gazzodown/src/emoji/EmojiRenderer.tsx3 CVEs · 0 functions
9packages/gazzodown/src/katex/KatexBlock.tsx3 CVEs · 0 functions
10packages/gazzodown/src/katex/KatexElement.tsx3 CVEs · 0 functions

Fix size

How much code a CVE fix in RocketChat/Rocket.Chat changes, with backports counted once.

35

Median lines changed

Added plus removed, per CVE

29%

Fixes of 20 lines or fewer

Share of CVE fixes

17%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in RocketChat/Rocket.Chat, and the functions each fix changed.

CVE-2026-65644
CVE-2026-65644
High · CVSS 7.5
EPSS 0.5%2026-08-21
CVE-2026-65645
CVE-2026-65645NotificationsModule
Medium · CVSS 4.3
EPSS 0.3%2026-08-21
Rocket.Chat: Broken Access Control in channels.convertToTeam Allows Unauthorized Conversion of Public Channels into Teams
CVE-2026-72919action
Medium · CVSS 4.3
EPSS 0.3%2026-08-10
Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8,...
CVE-2026-58066getElementId ResponseParser NotificationsModule
Critical · CVSS 9.8
EPSS 0.4%2026-07-30
CVE-2026-48616
CVE-2026-48616isValidAppleJWT deleteFileMessage getRequestUserId
Critical · CVSS 9.3
EPSS 0.4%2026-06-16
CVE-2026-48929
CVE-2026-48929isValidAppleJWT deleteFileMessage getRequestUserId
High · CVSS 7.5
EPSS 0.9%2026-06-16
CVE-2026-32995
CVE-2026-32995
High · CVSS 7.5
EPSS 0.5%2026-05-28
CVE-2026-29197
CVE-2026-29197addRoute
Medium · CVSS 4.3
EPSS 0.3%2026-04-23
CVE-2026-29198
CVE-2026-29198oAuth2ServerAuth authenticationMiddleware
Critical · CVSS 9.8
EPSS 0.6%2026-04-22
CVE-2026-22560
CVE-2026-22560processSLORedirectAction SAML
Medium · CVSS 5.3
EPSS 0.3%2026-04-10
Rocket.Chat: Users can login with any password via the EE ddp-streamer-service
CVE-2026-28514AppOAuthAppsBridge queue IStampedToken
Critical · CVSS 9.3
EPSS 0.8%2026-03-06
RocketChat parseMessage.js parseMessage redos
CVE-2025-5892
Medium · CVSS 5.3
EPSS 0.6%2025-06-09

Get an alert for each new RocketChat/Rocket.Chat CVE, with the patched functions and AI-written analysis.

Monitor Rocket.Chat CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

admidio/admidio24 CVEs android.googlesource.com/platform-external-libavc24 CVEs Budibase/budibase24 CVEs cesanta/mongoose24 CVEs coder/coder24 CVEs http4s/http4s24 CVEs OpenSC/OpenSC24 CVEs owncloud/core24 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in RocketChat/Rocket.Chat.

How many CVEs have a located fix in RocketChat/Rocket.Chat?: 24 published CVEs have a fix traced to functions in RocketChat/Rocket.Chat, touching 53 functions across 85 files.
Which function in RocketChat/Rocket.Chat has been patched by the most CVEs?: updateOTRAck in apps/meteor/app/otr/server/methods/updateOTRAck.ts has been changed by 3 CVE fixes, from 2024 to 2024.
How large is a typical CVE fix in RocketChat/Rocket.Chat?: The median fix changes 35 lines. 29% of fixes change 20 lines or fewer, and 17% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track RocketChat/Rocket.Chat CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing