# Rocket.Chat 8.7.1

- Product: Rocket.Chat (https://whatsnew.fyi/product/rocket-chat)
- Vendor: Rocket.Chat
- Date: 2026-08-19
- Version: 8.7.1
- Original notes: https://github.com/RocketChat/Rocket.Chat/releases/tag/8.7.1
- Permalink: https://whatsnew.fyi/product/rocket-chat/releases/8.7.1

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Add per-client rate limiting to the unauthenticated sendForgotPasswordEmail method, matching the REST users.forgotPassword endpoint
- **security** — Security hotfix
- **fixed** — Fix an issue where a MultiSelect option checkbox remained checked after the option was deselected
- **security** — Replace http with serverFetch in downloadPublicImportFile to add SSRF protection
- **fixed** — Fix special characters not being escaped in the visitor name shown in the Omnichannel queue side panel's message preview

###### Engine versions

- Node: `22.22.3`
- Deno: `2.3.1`
- MongoDB: `8.0`
- Apps-Engine: `1.65.1`

###### Patch Changes

*   Bump @rocket.chat/meteor version.

*   Bump @rocket.chat/meteor version.

*   ([#41818](https://github.com/RocketChat/Rocket.Chat/pull/41818) by [@dionisio-bot](https://github.com/dionisio-bot)) Adds per-client rate limiting to the unauthenticated sendForgotPasswordEmail method, matching the REST users.forgotPassword endpoint

*   ([#41820](https://github.com/RocketChat/Rocket.Chat/pull/41820) by [@dionisio-bot](https://github.com/dionisio-bot)) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)

*   ([#41846](https://github.com/RocketChat/Rocket.Chat/pull/41846)) Fixes an issue where a `MultiSelect` option checkbox remained checked after the option was deselected

*   ([#41819](https://github.com/RocketChat/Rocket.Chat/pull/41819) by [@dionisio-bot](https://github.com/dionisio-bot)) Replace http with serverFetch in downloadPublicImportFile to add SSRF protection

*   ([#41817](https://github.com/RocketChat/Rocket.Chat/pull/41817) by [@dionisio-bot](https://github.com/dionisio-bot)) Fixes special characters not being escaped in the visitor name shown in the Omnichannel queue side panel's message preview

*   <details><summary>Updated dependencies []:</summary>

    *   @rocket.chat/core-typings@8.7.1
    *   @rocket.chat/rest-typings@8.7.1

    </details>