VYPR
Moderate severityNVD Advisory· Published Aug 20, 2024· Updated Sep 3, 2024

A room with itself as a its predecessor will freeze matrix-js-sdk

CVE-2024-42369

Description

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk's getRoomUpgradeHistory function will infinitely recurse in this case, causing the code to hang. This method is public but also called by the 'leaveRoomChain()' method, so leaving a room will also trigger the bug. This was patched in matrix-js-sdk 34.3.1.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
matrix-js-sdknpm
< 34.3.134.3.1

Affected products

1

Patches

1
a0efed8b881b

Merge commit from fork

https://github.com/matrix-org/matrix-js-sdkDavid BakerAug 20, 2024via ghsa
1 file changed · +5 0
  • src/client.ts+5 0 modified
    @@ -5587,10 +5587,15 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     
         private findPredecessorRooms(room: Room, verifyLinks: boolean, msc3946ProcessDynamicPredecessor: boolean): Room[] {
             const ret: Room[] = [];
    +        const seenRoomIDs = new Set<string>([room.roomId]);
     
             // Work backwards from newer to older rooms
             let predecessorRoomId = room.findPredecessor(msc3946ProcessDynamicPredecessor)?.roomId;
             while (predecessorRoomId !== null) {
    +            if (predecessorRoomId) {
    +                if (seenRoomIDs.has(predecessorRoomId)) break;
    +                seenRoomIDs.add(predecessorRoomId);
    +            }
                 const predecessorRoom = this.getRoom(predecessorRoomId);
                 if (predecessorRoom === null) {
                     break;
    

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.