mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the same process and return the converted HTML can also disclose the contents of local server files (to the party supplying the documents) by setting externalFileAccess to true.
RabbitMQ versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 contain a vulnerability in the consistent-hash exchange plugin where the add_binding/3 function parses the routing key as an integer weight without an upper bound. This allows a user with write permission on a consistent-hash exchange and read permission on a queue to create a binding with an arbitrarily large weight, causing excessive memory allocation (~800 MB for weight 100000000) on all cluster nodes. The allocated list is persisted cluster-wide and survives restarts, potentially leading to resource exhaustion. The issue is fixed in the specified versions.
CVE-2026-67220 is a vulnerability in RabbitMQ server affecting versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0. It involves the handling of bindings on x-jms-topic exchanges where the server processes selector strings without length limits or proper validation, leading to atom table exhaustion. An authenticated low-privilege AMQP user confined to one virtual host can cause a denial of service by crashing the broker node with fewer than 100 bind calls. The issue requires the rabbitmq_jms_topic_exchange plugin to be enabled and specific permissions on exchanges and queues. Fixed versions have been released to address this issue.
CVE-2026-67224 is a vulnerability in RabbitMQ server's tracing plugin that allows an administrator user to write arbitrary .log files to any filesystem path writable by the RabbitMQ OS user. This occurs because the trace consumer does not apply safe relative path or traversal checks on the write side, enabling potential arbitrary file overwrite or creation outside the intended trace directory. The vulnerability requires the tracing plugin to be enabled and administrator privileges. It is fixed in RabbitMQ versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.
CVE-2026-67229 affects RabbitMQ server versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0. An administrator importing a crafted definitions file with a vhost entry containing approximately one million unique metadata keys can exhaust the Erlang atom table, causing the node to crash. This vulnerability arises from the use of an unsafe function that converts binary keys to atoms during vhost metadata processing. The issue requires administrator privileges to exploit and is fixed in the specified versions.
CVE-2026-67235 is a vulnerability in RabbitMQ server versions prior to 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15 where the content-header BodySize field was not validated against max_message_size until assembly completion. This allows an authenticated AMQP 0-9-1 client with publish permission to cause unbounded memory accumulation by declaring an extremely large body size and streaming fragments, potentially leading to memory exhaustion and cluster-wide degradation. The issue is mitigated partially by a reactive memory alarm but is fixed in the stated versions.
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, When no CA bundle is available, ssl_options/1 falls back to [{verify, verify_none}] with no warning. An attacker in a man-in-the-middle position can forge the JWKS response, which leads the broker to accept arbitrary JWTs. Preconditions include The OAuth2 plugin must be in use with no cacertfile configured and the OS CA bundle empty or unreadable (for example, in a minimal container), and the attacker must hold a network man-in-the-middle position.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
RabbitMQ server versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1 contain a vulnerability in the rabbitmq_stream plugin where an authenticated stream client with read access can cause the broker node to crash. This occurs because the get_chunk_selector/1 function calls binary_to_atom on untrusted client-supplied data without validation. The issue is fixed in the specified versions.
CVE-2026-66075 affects RabbitMQ server versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1. The vulnerability allows a user with monitoring privileges to restart any federation link, a state-changing operation that disrupts message flow. This occurs because the authorization check for the /federation-links/.../restart route incorrectly uses a monitoring authorization function that permits DELETE methods without per-method elevation checks. The issue requires the rabbitmq_federation and rabbitmq_federation_management plugins to be enabled. The vulnerability is fixed in the specified versions.
CVE-2026-66077 is a cross-site scripting (XSS) vulnerability in RabbitMQ's management UI prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6. The issue arises because the management UI uses EJS 1.0 templating which does not HTML-escape certain certificate subject fields. An attacker who can obtain a TLS client certificate signed by a trusted CA and with a crafted Subject DN can inject JavaScript that executes in the administrator's browser when viewing connection details. This allows full account takeover capabilities via the management UI. The vulnerability requires the TLS listener to be configured with verify_peer enabled and the attacker to have a CA-signed client certificate. A fix is available in the stated versions.
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqp_uri:remove_credentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET /api/shovels and via rabbitmqctl shovel_status. Preconditions include The Shovel plugin must be in use with AMQP 1.0 shovels configured using URI-embedded credentials. Reading the exposed status requires the monitoring tag.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The trust-store plugin installs a verify_fun that overrides {bad_cert, unknown_ca} / {bad_cert, selfsigned_peer} when the presented cert "matches" a whitelisted one. The match key is extract_issuer_id/1 → public_key:pkix_issuer_id/2 → {IssuerName, SerialNumber} , both fields are taken verbatim from the presented certificate body and contain no public-key, SKI, fingerprint or signature material. is_whitelisted/1 is a pure ets:member lookup; the stored full DER is used only for list/0 display and is never compared against the presented cert. cacerts is [], so the whitelisted cert is never used as a trust anchor for path validation either. TLS client-authentication bypass: an attacker who knows the issuer DN + serial of any whitelisted certificate can connect with a forged self-signed cert. Preconditions include rabbitmq_trust_store plugin enabled and used as the TLS verify_fun Attacker knows or can guess the {Issuer, Serial} of at least one whitelisted cert (non-secret; exposed via CLI/logs/any cert copy). This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, match_value/3 passes the user-supplied ?name= regular expression to re:run with no match_limit option, and executes it once per resource in the result set. OTP's default 10M match_limit caps each call at roughly 100-200ms, but the regex runs once per resource in the result set. With a large set, for example 5000 queues at 150ms each, a single request consumes 12 or more minutes of CPU. Parallel requests saturate the schedulers. The use_regex=true option is a supported feature on list endpoints, so this path is reachable through normal API use. Preconditions include Any user with the management tag can exploit this.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress => true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set max_frame_size, so cowboy's default of infinity applies. cowlib's cow_ws:parse_payload/9 calls zlib:inflate/2 on the compressed payload with no output-size limit. An attacker can negotiate permessage-deflate during the WebSocket upgrade and send a frame containing a zlib bomb (e.g. 50 KB → 5 GB). Decompression occurs in the connection process before websocket_handle/2 ever sees the MQTT bytes. An unauthenticated attacker can crash a RabbitMQ node running the Web-MQTT plugin by sending a single highly-compressed WebSocket frame (a few KB on the wire) that inflates to gigabytes in memory. The cowboy WebSocket handler decompresses the entire frame before the MQTT CONNECT packet is processed, so no credentials are required. Preconditions include rabbitmq_web_mqtt plugin enabled (not default, but common for browser clients) Network reachability to port 15675/15676 No authentication required. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the Web-MQTT handler (deps/rabbitmq_web_mqtt/src/rabbit_web_mqtt_handler.erl:104) nor the Web-STOMP handler (deps/rabbitmq_web_stomp/src/rabbit_web_stomp_handler.erl:102) validates the Origin header on the WebSocket upgrade. Under ssl_cert_login=true, the browser presents the client certificate automatically, so an attacker's JavaScript running in the victim's browser can authenticate as the victim. Preconditions include The non-default configuration use_http_auth=true (Web-STOMP) or ssl_cert_login=true (both plugins) must be enabled. The issue is harmless under the default in-band CONNECT credential configuration.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.