matrix-js-sdk
npm12 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting matrix-js-sdkpage 1 of 1
- CVE-2021-40823MEDIUMCVSS 5.9EG 5.9✓ Fixed in 12.4.12021-09-13
A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12.4.1 allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys (via crafted Matrix protocol mes…
- CVE-2022-36059HIGHCVSS 8.2EG 8.2✓ Fixed in 19.4.02023-03-28
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 19.4.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potent…
- CVE-2022-39236MEDIUMCVSS 4.3EG 4.3✓ Fixed in 19.7.02022-09-28
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Starting with version 17.1.0-rc.1, improperly formed beacon events can disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer'…
- CVE-2022-39249HIGHCVSS 7.5EG 7.5✓ Fixed in 19.7.02022-09-28
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be mar…
- CVE-2022-39250HIGHCVSS 8.6EG 8.6✓ Fixed in 19.7.02022-09-29
Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, inj…
- CVE-2022-39251HIGHCVSS 8.6EG 8.6✓ Fixed in 19.7.02022-09-28
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without an…
- CVE-2023-28427HIGHCVSS 8.2EG 8.2✓ Fixed in 24.0.02023-03-28
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potent…
- CVE-2023-29529MEDIUMCVSS 5.0EG 5.0✓ Fixed in 24.1.02023-04-14
matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. An attacker present in a room where an MSC3401 group call is taking place can eavesdrop on the video and audio of participants using matrix-js-sdk, without their …
- CVE-2024-42369MEDIUMCVSS 4.1EG 4.1✓ Fixed in 34.3.12024-08-20
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk's getRoomUpgradeHistory function will infin…
- CVE-2024-47080HIGHCVSS 8.7EG 0.0✓ Fixed in 34.8.02024-10-15
matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. In matrix-js-sdk versions versions 9.11.0 through 34.7.0, the method `MatrixClient.sendSharedHistoryKeys` is vulnerable to interception by malicious homeservers. …
- CVE-2024-50336MEDIUMCVSS 5.3EG 0.0✓ Fixed in 34.11.12024-11-12
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-j…
- CVE-2025-59160NONECVSS 0.0EG 0.0✓ Fixed in 38.2.02025-09-16
Matrix JavaScript SDK is a Matrix Client-Server SDK for JavaScript and TypeScript. matrix-js-sdk before 38.2.0 has insufficient validation of room predecessor links in MatrixClient::getJoinedRooms, allowing a remote attacker to attempt to …
Check whether matrix-js-sdk is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for matrix-js-sdk CVEs against the assets you own.
Start Free Scan →