Vulnerability advisory

CVE-2024-42369

A room with itself as a its predecessor will freeze matrix-js-sdk

Published Aug 20, 2024Updated Oct 28, 2026OSV record ↗

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/matrix-org/matrix-js-sdk ↗
All commits before 340bbe1a8fae05a514ac133e6e9b549326854957	`340bbe1a8fae05a514ac133e6e9b549326854957`
Not specified	`a0efed8b881b3db6c9f2c71d6a6e74c2828978c6`
Also listed as affected (66) `v34.3.0` `v34.3.0-rc.1` `v34.3.0-rc.0` `v34.2.0` `v31.2.0-rc.0` `v30.2.0-rc.0` `v30.1.0-rc.0` `v30.1.0-rc.1` `v26.2.0-no-media-devices-hotfix` `no-media-devices-release` `v26.1.0-patch.1` `v8.1.0` `v8.1.0-rc.1` `v8.0.0` `v7.1.0` `v7.1.0-rc.1` `v5.0.1` `v2.4.1` `v2.0.1` `v2.0.1-rc.2` `v2.0.1-rc.1` `v1.0.0` `v1.0.0-rc.2` `v1.0.0-rc.1` `v0.11.0` `v0.11.0-rc.1` `v0.10.7` `v0.10.7-rc.1` `v0.10.5` `v0.10.5-rc.1` `v0.10.3` `v0.10.2` `v0.10.3-rc.1` `v0.10.2-rc.1` `v0.8.3` `v0.8.3-rc.1` `v0.8.2` `v0.8.1` `v0.8.1-rc.1` `v0.8.0` `v0.7.10` `v0.7.9` `v0.7.4` `v0.7.4-rc.1` `v0.7.2` `v0.7.1-rc.1` `v0.6.4` `v0.6.4-rc.2` `v0.6.2` `v0.6.1` `v0.6.0-rc2` `v0.6.0-rc1` `v0.5.6` `v0.5.5` `v0.5.4` `v0.5.3` `v0.5.2` `v0.5.1` `v0.5.0` `v0.4.2` `v0.4.1` `v0.2.2` `v0.2.1` `v0.2.0` `v0.1.1` `v0.1.0`

Description

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk's getRoomUpgradeHistory function will infinitely recurse in this case, causing the code to hang. This method is public but also called by the 'leaveRoomChain()' method, so leaving a room will also trigger the bug. This was patched in matrix-js-sdk 34.3.1.

CVE-2024-42369

Affected versions

Repository

Description

References