A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix…
Priority LOW 28CWE-290Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass, Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-290 and CWE-200.
Summary
A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12.4.1 allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys (via crafted Matrix protocol messages) that were originally sent by affected Matrix clients participating in that room. This allows the homeserver to decrypt end-to-end encrypted messages sent by affected clients.
Why it matters now
EPSS 0.00662 51st percentileScored 2026-11-07
Fix Fixed matrix-js-sdk (npm): 12.4.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | matrix-js-sdk (npm) | before 12.4.1 | 12.4.1 | Patch available | GHSA-23cm-x6j7-6hq3 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- matrix-js-sdk (npm) Vendor— Affected before 12.4.1 Fixed in 12.4.1 Patch available GHSA-23cm-x6j7-6hq3
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:matrix:javascript_sdk:*:*:*:*:*:*:*:* | before 12.4.1 | Vulnerable | matrix-org |
- cpe:2.3:a:matrix:javascript_sdk:*:*:*:*:*:*:*:* Versions before 12.4.1 Vulnerable ·matrix-org
Remediation
- Fix · GHSA-23cm-x6j7-6hq3 matrix-js-sdk (npm) Fixed in 12.4.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-40823
- 2026-10-03 Alias added: GHSA-23cm-x6j7-6hq3
- 2026-10-06 EPSS moved to the 50th–90th percentile
References
Advisory 3
More matrix-org Javascript Sdk vulnerabilities
- TI-2022-18627 Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusion CVSS 3.1HIGH 8.6
- TI-2022-18626 Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verification CVSS 3.1HIGH 8.6
- TI-2021-20136 The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer… CVSS 3.1CRITICAL 9.8
- TI-2023-12971 Prototype pollution in matrix-js-sdk CVSS 3.1HIGH 8.2
- TI-2022-16482 Prototype pollution in matrix-js-sdk CVSS 3.1HIGH 8.2
- TI-2022-18625 Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessions CVSS 3.1HIGH 7.5
Sources
- CVE-2021-40823 · CVE Program
- CVE-2021-40823 · NVD
- FIRST EPSS
- GHSA-23cm-x6j7-6hq3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences