TI-2022-18627 Aliases CVE-2022-39251 GHSA-r48r-j8fx-mq2c

Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusion

MEDIUM 46CWE-287Published 2022-09-28 · Updated 2025-04-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · High · None
Fix status: Partial Red Hat: 8 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-287.

Summary

Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Additionally, a sophisticated attacker cooperating with a malicious homeserver could employ this vulnerability to perform a targeted attack in order to send fake to-device messages appearing to originate from another user. This can allow, for example, to inject the key backup secret during a self-verification, to make a targeted device start using a malicious key backup spoofed by the homeserver. These attacks are possible due to a protocol confusion vulnerability that accepts to-device messages encrypted with Megolm instead of Olm. Starting with version 19.7.0, matrix-js-sdk has been modified to only accept Olm-encrypted to-device messages. Out of caution, several other checks have been audited or added. This attack requires coordination between a malicious home server and an attacker, so those who trust their home servers do not need a workaround.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01176 67th percentileScored 2026-11-07

Fix Partial matrix-js-sdk (matrix-org): 19.7.0matrix-js-sdk (npm): 19.7.0Red Hat: 6 advisoriesRed Hat: 8 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
matrix-org	matrix-js-sdk	before 19.7.0	19.7.0	Patch available	CNA
—	matrix-js-sdk (npm)	before 19.7.0	19.7.0	Patch available	GHSA-r48r-j8fx-mq2c

matrix-js-sdk Vendormatrix-org Affected before 19.7.0 Fixed in 19.7.0 Patch available CNA
matrix-js-sdk (npm) Vendor— Affected before 19.7.0 Fixed in 19.7.0 Patch available GHSA-r48r-j8fx-mq2c

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:matrix:javascript_sdk::::::node.js::*	before 19.7.0	Vulnerable	matrix-org

cpe:2.3:a:matrix:javascript_sdk:*:*:*:*:*:node.js:*:* Versions before 19.7.0 Vulnerable ·matrix-org

Remediation

Fix · CNA matrix-js-sdk (matrix-org) Fixed in 19.7.0
Fix · GHSA-r48r-j8fx-mq2c matrix-js-sdk (npm) Fixed in 19.7.0 Advisory →

Red Hat 6 advisories

RHSA-2022:7190 Released 2022-10-25 · Red Hat rating Important
thunderbird security update
- Red Hat Enterprise Linux AppStream (v. 8) thunderbird-102.4.0-1.el8_6
RHSA-2022:7184 Released 2022-10-25 · Red Hat rating Important
thunderbird security update
- Red Hat Enterprise Linux Client (v. 7) thunderbird-102.4.0-1.el7_9
- Red Hat Enterprise Linux Server Optional (v. 7) thunderbird-102.4.0-1.el7_9
- Red Hat Enterprise Linux Workstation (v. 7) thunderbird-102.4.0-1.el7_9
RHSA-2022:7181 Released 2022-10-25 · Red Hat rating Important
thunderbird security update
- Red Hat Enterprise Linux AppStream EUS (v.8.4) thunderbird-102.4.0-1.el8_4

Show 3 more Red Hat advisories

RHSA-2022:7183 Released 2022-10-25 · Red Hat rating Important
thunderbird security update
- Red Hat Enterprise Linux AppStream E4S (v. 8.1) thunderbird-102.4.0-1.el8_1
RHSA-2022:7182 Released 2022-10-25 · Red Hat rating Important
thunderbird security update
- Red Hat Enterprise Linux AppStream EUS (v. 8.2) thunderbird-102.4.0-1.el8_2
RHSA-2022:7178 Released 2022-10-25 · Red Hat rating Important
thunderbird security update
- Red Hat Enterprise Linux AppStream (v. 9) thunderbird-102.4.0-1.el9_0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2022-09-28
matrix-org matrix-js-sdk — GLSA-202210-35
4 records Highest priority Priority MEDIUM 3 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2022-18626 Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verificationPriority MEDIUM 46
- TI-2022-18625 Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessionsPriority MEDIUM 41
- TI-2022-18613 Matrix Javascript SDK improper beacon events can cause availability issuesPriority LOW 27
Show all 4 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 8)	Fixed	RHSA-2022:7190
Red Hat Enterprise Linux AppStream (v. 9)	Fixed	RHSA-2022:7178
Red Hat Enterprise Linux AppStream E4S (v. 8.1)	Fixed	RHSA-2022:7183
Red Hat Enterprise Linux AppStream EUS (v. 8.2)	Fixed	RHSA-2022:7182
Red Hat Enterprise Linux AppStream EUS (v.8.4)	Fixed	RHSA-2022:7181
Red Hat Enterprise Linux Client (v. 7)	Fixed	RHSA-2022:7184
Red Hat Enterprise Linux Server Optional (v. 7)	Fixed	RHSA-2022:7184
Red Hat Enterprise Linux Workstation (v. 7)	Fixed	RHSA-2022:7184

Timeline

2026-10-02 Threatist record created from CVE-2022-39251
2026-10-03 Alias added: GHSA-r48r-j8fx-mq2c

References

Patch 1

https://github.com/matrix-org/matrix-js-sdk/commit/a587d7c36026fe1fcf93dfff63588abee359be76

Advisory 5

Other 1

https://github.com/matrix-org/matrix-js-sdk

TI-2022-18626 Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verification CVSS 3.1HIGH 8.6
TI-2021-20136 The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer… CVSS 3.1CRITICAL 9.8
TI-2023-12971 Prototype pollution in matrix-js-sdk CVSS 3.1HIGH 8.2
TI-2022-16482 Prototype pollution in matrix-js-sdk CVSS 3.1HIGH 8.2
TI-2022-18625 Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessions CVSS 3.1HIGH 7.5
TI-2021-17748 A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix… CVSS 3.1MEDIUM 5.9

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences