Read the docs
TI-2022-16482 Aliases CVE-2022-36059GHSA-rfv9-x7hh-xc32

Prototype pollution in matrix-js-sdk

Priority MEDIUM 43CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · High
Fix status
Partial Red Hat: 8 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 19.4.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This issue has been fixed in matrix-js-sdk 19.4.0 and users are advised to upgrade. Users unable to upgrade may mitigate this issue by redacting applicable events, waiting for the sync processor to store data, and restarting the client. Alternatively, redacting the applicable events and clearing all storage will often fix most perceived issues. In some cases, no workarounds are possible.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00932 60th percentileScored 2026-11-07
Fix Partial matrix-js-sdk (matrix-org): 19.4.0matrix-js-sdk (npm): 19.4.0Red Hat: 6 advisoriesRed Hat: 8 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
matrix-orgmatrix-js-sdkbefore 19.4.019.4.0Patch availableCNA
—matrix-js-sdk (npm)before 19.4.019.4.0Patch availableGHSA-rfv9-x7hh-xc32
  • matrix-js-sdk Vendormatrix-org Affected before 19.4.0 Fixed in 19.4.0 Patch available CNA
  • matrix-js-sdk (npm) Vendor— Affected before 19.4.0 Fixed in 19.4.0 Patch available GHSA-rfv9-x7hh-xc32

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:matrix:javascript_sdk:*:*:*:*:*:node.js:*:*before 19.4.0Vulnerablematrix-org
  • cpe:2.3:a:matrix:javascript_sdk:*:*:*:*:*:node.js:*:* Versions before 19.4.0 Vulnerable ·matrix-org

Remediation

  • Fix · CNA matrix-js-sdk (matrix-org) Fixed in 19.4.0
  • Fix · GHSA-rfv9-x7hh-xc32 matrix-js-sdk (npm) Fixed in 19.4.0 Advisory →

Red Hat 6 advisories

  • RHSA-2022:6717 Released 2022-09-26 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream (v. 9) thunderbird-102.3.0-3.el9_0
  • RHSA-2022:6715 Released 2022-09-26 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream EUS (v. 8.2) thunderbird-102.3.0-3.el8_2
  • RHSA-2022:6716 Released 2022-09-26 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream E4S (v. 8.1) thunderbird-102.3.0-3.el8_1
Show 3 more Red Hat advisories
  • RHSA-2022:6708 Released 2022-09-26 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream (v. 8) thunderbird-102.3.0-3.el8_6
  • RHSA-2022:6710 Released 2022-09-26 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux Client (v. 7) thunderbird-102.3.0-3.el7_9
    • Red Hat Enterprise Linux Server Optional (v. 7) thunderbird-102.3.0-3.el7_9
    • Red Hat Enterprise Linux Workstation (v. 7) thunderbird-102.3.0-3.el7_9
  • RHSA-2022:6713 Released 2022-09-26 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.4) thunderbird-102.3.0-3.el8_4

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2022:6708
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2022:6717
Red Hat Enterprise Linux AppStream E4S (v. 8.1)Fixed RHSA-2022:6716
Red Hat Enterprise Linux AppStream EUS (v. 8.2)Fixed RHSA-2022:6715
Red Hat Enterprise Linux AppStream EUS (v.8.4)Fixed RHSA-2022:6713
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2022:6710
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2022:6710
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2022:6710

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-36059
  2. 2026-10-03 Alias added: GHSA-rfv9-x7hh-xc32

References

Advisory 2

Other 2

  • TI-2022-18627 Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusion CVSS 3.1HIGH 8.6
  • TI-2022-18626 Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verification CVSS 3.1HIGH 8.6
  • TI-2021-20136 The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer… CVSS 3.1CRITICAL 9.8
  • TI-2023-12971 Prototype pollution in matrix-js-sdk CVSS 3.1HIGH 8.2
  • TI-2022-18625 Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessions CVSS 3.1HIGH 7.5
  • TI-2021-17748 A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix… CVSS 3.1MEDIUM 5.9
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences