TI-2024-28355 Aliases CVE-2024-42369 GHSA-vhr5-g3pm-49fm

A room with itself as a its predecessor will freeze matrix-js-sdk

LOW 25CWE-674Published 2024-08-20 · Updated 2024-09-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-674.

Summary

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk's getRoomUpgradeHistory function will infinitely recurse in this case, causing the code to hang. This method is public but also called by the 'leaveRoomChain()' method, so leaving a room will also trigger the bug. This was patched in matrix-js-sdk 34.3.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00483 41st percentileScored 2026-11-07

Fix Fixed matrix-js-sdk (matrix-org): 34.3.1matrix-js-sdk (npm): 34.3.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
matrix-org	matrix-js-sdk	before 34.3.1	34.3.1	Patch available	CNA
—	matrix-js-sdk (npm)	before 34.3.1	34.3.1	Patch available	GHSA-vhr5-g3pm-49fm

matrix-js-sdk Vendormatrix-org Affected before 34.3.1 Fixed in 34.3.1 Patch available CNA
matrix-js-sdk (npm) Vendor— Affected before 34.3.1 Fixed in 34.3.1 Patch available GHSA-vhr5-g3pm-49fm

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:matrix:javascript_sdk::::::::	before 34.3.1	Vulnerable	matrix-org

cpe:2.3:a:matrix:javascript_sdk:*:*:*:*:*:*:*:* Versions before 34.3.1 Vulnerable ·matrix-org

Remediation

Fix · CNA matrix-js-sdk (matrix-org) Fixed in 34.3.1
Fix · GHSA-vhr5-g3pm-49fm matrix-js-sdk (npm) Fixed in 34.3.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-42369
2026-10-03 Alias added: GHSA-vhr5-g3pm-49fm

References

Patch 1

https://github.com/matrix-org/matrix-js-sdk/commit/a0efed8b881b3db6c9f2c71d6a6e74c2828978c6

Advisory 2

Other 1

https://github.com/matrix-org/matrix-js-sdk

TI-2022-18627 Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusion CVSS 3.1HIGH 8.6
TI-2022-18626 Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verification CVSS 3.1HIGH 8.6
TI-2021-20136 The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer… CVSS 3.1CRITICAL 9.8
TI-2023-12971 Prototype pollution in matrix-js-sdk CVSS 3.1HIGH 8.2
TI-2022-16482 Prototype pollution in matrix-js-sdk CVSS 3.1HIGH 8.2
TI-2022-18625 Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessions CVSS 3.1HIGH 7.5

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences