CVE-2021-22911: Critical NoSQL Injection in Rocket.Chat

CVE-2021-22911 identifies an improper input sanitization vulnerability in Rocket.Chat server versions 3.11, 3.12, and 3.13. The flaw allows unauthenticated NoSQL injection attacks, which could lead to remote code execution (RCE) on the server. Any user accessing the Rocket.Chat instance, even without credentials, may potentially exploit this weakness to compromise the system.

The vulnerability has a CVSS score of 9.8 (critical). According to NVD, severity is classified as critical. A recent GitHub signal (November 4, 2026) suggests renewed attention to this flaw, even 5 years after the original publication (May 27, 2021). Although the signal lacks description, its presence warrants vigilance from system administrators.

If the organization uses Rocket.Chat on versions 3.11, 3.12, or 3.13, immediate update is a priority. Check the official Rocket.Chat repository for patches and fixes. In the meantime, monitor service access, restrict network exposure where possible, and implement WAF protections to mitigate NoSQL injection attempts. Track anomalies in application and database logs to detect exploitation attempts.