Read the docs
TI-2022-18613 Aliases CVE-2022-39236GHSA-hvv8-5v86-r45x

Matrix Javascript SDK improper beacon events can cause availability issues

Priority LOW 27CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 8 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Starting with version 17.1.0-rc.1, improperly formed beacon events can disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This is patched in matrix-js-sdk v19.7.0. Redacting applicable events, waiting for the sync processor to store data, and restarting the client are possible workarounds. Alternatively, redacting the applicable events and clearing all storage will fix the further perceived issues. Downgrading to an unaffected version, noting that such a version may be subject to other vulnerabilities, will additionally resolve the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01361 71st percentileScored 2026-11-07
Fix Partial matrix-js-sdk (matrix-org): 19.7.0matrix-js-sdk (npm): 19.7.0Red Hat: 6 advisoriesRed Hat: 8 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
matrix-orgmatrix-js-sdk17.1.0-rc.1 to before 19.7.019.7.0Patch availableCNA
—matrix-js-sdk (npm)17.1.0-rc.1 to before 19.7.019.7.0Patch availableGHSA-hvv8-5v86-r45x
  • matrix-js-sdk Vendormatrix-org Affected 17.1.0-rc.1 to before 19.7.0 Fixed in 19.7.0 Patch available CNA
  • matrix-js-sdk (npm) Vendor— Affected 17.1.0-rc.1 to before 19.7.0 Fixed in 19.7.0 Patch available GHSA-hvv8-5v86-r45x

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:matrix:javascript_sdk:*:*:*:*:*:node.js:*:*17.1.0 to before 19.7.0Vulnerablematrix-org
cpe:2.3:a:matrix:javascript_sdk:17.1.0:rc1:*:*:*:node.js:*:*17.1.0 rc1Vulnerablematrix-org
  • cpe:2.3:a:matrix:javascript_sdk:*:*:*:*:*:node.js:*:* Versions 17.1.0 to before 19.7.0 Vulnerable ·matrix-org
  • cpe:2.3:a:matrix:javascript_sdk:17.1.0:rc1:*:*:*:node.js:*:* Versions 17.1.0 rc1 Vulnerable ·matrix-org

Remediation

  • Fix · CNA matrix-js-sdk (matrix-org) Fixed in 19.7.0
  • Fix · GHSA-hvv8-5v86-r45x matrix-js-sdk (npm) Fixed in 19.7.0 Advisory →

Red Hat 6 advisories

  • RHSA-2022:7190 Released 2022-10-25 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream (v. 8) thunderbird-102.4.0-1.el8_6
  • RHSA-2022:7184 Released 2022-10-25 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux Client (v. 7) thunderbird-102.4.0-1.el7_9
    • Red Hat Enterprise Linux Server Optional (v. 7) thunderbird-102.4.0-1.el7_9
    • Red Hat Enterprise Linux Workstation (v. 7) thunderbird-102.4.0-1.el7_9
  • RHSA-2022:7181 Released 2022-10-25 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.4) thunderbird-102.4.0-1.el8_4
Show 3 more Red Hat advisories
  • RHSA-2022:7183 Released 2022-10-25 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream E4S (v. 8.1) thunderbird-102.4.0-1.el8_1
  • RHSA-2022:7182 Released 2022-10-25 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream EUS (v. 8.2) thunderbird-102.4.0-1.el8_2
  • RHSA-2022:7178 Released 2022-10-25 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream (v. 9) thunderbird-102.4.0-1.el9_0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    matrix-org matrix-js-sdk — GLSA-202210-35

    4 records Highest priority Priority MEDIUM 3 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2022-18627 Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusionPriority MEDIUM 46
    • TI-2022-18626 Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verificationPriority MEDIUM 46
    • TI-2022-18625 Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessionsPriority MEDIUM 41
    Show all 4 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2022:7190
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2022:7178
Red Hat Enterprise Linux AppStream E4S (v. 8.1)Fixed RHSA-2022:7183
Red Hat Enterprise Linux AppStream EUS (v. 8.2)Fixed RHSA-2022:7182
Red Hat Enterprise Linux AppStream EUS (v.8.4)Fixed RHSA-2022:7181
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2022:7184
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2022:7184
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2022:7184

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-39236
  2. 2026-10-03 Alias added: GHSA-hvv8-5v86-r45x

References

Patch 2

Advisory 4

Other 1

  • TI-2022-18627 Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusion CVSS 3.1HIGH 8.6
  • TI-2022-18626 Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verification CVSS 3.1HIGH 8.6
  • TI-2021-20136 The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer… CVSS 3.1CRITICAL 9.8
  • TI-2023-12971 Prototype pollution in matrix-js-sdk CVSS 3.1HIGH 8.2
  • TI-2022-16482 Prototype pollution in matrix-js-sdk CVSS 3.1HIGH 8.2
  • TI-2022-18625 Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessions CVSS 3.1HIGH 7.5
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences