- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 12 · 6 high, 4 medium, 1 low
- Registry
- npm
Advisories 12
- CVE-2025-59160Low 2.7
matrix-js-sdk has insufficient validation when considering a room to be upgraded by another
Affected: fixed in 38.2.0.
- CVE-2024-50336Medium 5.3
matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal
Affected: fixed in 34.11.1.
- CVE-2024-47080High 8.7
matrix-js-sdk keys sent via `sendSharedHistoryKeys` vulnerable to interception by malicious homeserver
Affected: from 9.11.0, fixed in 34.8.0.
- CVE-2024-42369Medium 4.1
A room with itself as a its predecessor will freeze matrix-js-sdk
Affected: fixed in 34.3.1.
- CVE-2023-29529Medium 5.0
matrix-js-sdk vulnerable to invisible eavesdropping in group calls
Affected: fixed in 24.1.0.
- CVE-2023-28427High 8.2
Prototype pollution in matrix-js-sdk
Affected: fixed in 24.0.0.
- CVE-2022-36059High 8.2
Prototype pollution in matrix-js-sdk
Affected: fixed in 19.4.0.
- CVE-2022-39250High 8.6
Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verification
Affected: fixed in 19.7.0.
- CVE-2022-39251High 8.6
Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusion
Affected: fixed in 19.7.0.
- CVE-2022-39249High 7.5
Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessions
Affected: fixed in 19.7.0.
- CVE-2022-39236Medium 4.3
Matrix Javascript SDK improper beacon events can cause availability issues
Affected: from 17.1.0-rc.1, fixed in 19.7.0.
- CVE-2021-40823Unrated
A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12.4.1 allows a malicious Matrix…
Affected: fixed in 12.4.1.