matrix-js-sdk will freeze when a user sets a room with itself as a its predecessor
Impact
A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk's getRoomUpgradeHistory function will infinitely recurse in this case, causing the code to hang. This method is public but also called by the 'leaveRoomChain()' method, so leaving a room will also trigger the bug.
Even if the CVSS score would be 4.1 (AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L) we classify this as High severity issue.
Patches
This was patched in matrix-js-sdk 34.3.1.
Workarounds
Sanity check rooms before passing them to the matrix-js-sdk or avoid calling either getRoomUpgradeHistory or leaveRoomChain.
References
N/A.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | matrix-js-sdk | < 34.3.1 | 34.3.1 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L- Weakness (CWE)
CWE-674- Platform
- npm
- Package
matrix-js-sdk- Disclosed
- 20.08.2024
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-vhr5-g3pm-49fm - CC BY 4.0
Vulnerability history: matrix-js-sdk
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 12
- First → latest
- 09.2021 09.2025
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 6
- Medium 6
Disclosures per year
- 2021: 1
- 2022: 4
- 2023: 3
- 2024: 3
- 2025: 1
- 2026: 0
-
matrix-js-sdk will freeze when a user sets a room with itself as a its predecessor this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.