p PatchFirst

CVE-2025-59160

CVE-2025-59160 · matrix-js-sdk has insufficient validation when considering a room to be upgraded by another

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Matrix JavaScript SDK is a Matrix Client-Server SDK for JavaScript and TypeScript. matrix-js-sdk before 38.2.0 has insufficient validation of room predecessor links in MatrixClient::getJoinedRooms, allowing a remote attacker to attempt to replace a tombstoned room with an unrelated attacker-supplied room. The issue has been patched and users should upgrade to 38.2.0. A workaround is to avoid using MatrixClient::getJoinedRooms in favor of getRooms() and filtering upgraded rooms separately.

CVSS 2.7 · Low · EPSS 0.2% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • matrix-js-sdk

    Versions
    • < 38.2.0: Affected

    No fix published

  • node-matrix-js-sdk Debian:11

    Versions
    • 9.11.0+~cs9.9.16-1
    • 9.11.0+~cs9.9.16-2
    • 9.3.0+~cs9.9.16-2
    • 9.7.0~~rc1+~cs9.9.16-1
    • 9.7.0~~rc1+~cs9.9.16-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • matrix-js-sdk npm

    Affected ranges
    • SEMVER: < 38.2.0

    Update to 38.2.0

  • node-matrix-js-sdk Ubuntu:20.04:LTS

    Versions
    • 0.9.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-matrix-js-sdk Ubuntu:22.04:LTS

    Versions
    • 9.3.0+~cs9.9.16-2
    • 9.11.0+~cs9.9.16-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-matrix-js-sdk Ubuntu:24.04:LTS

    Versions
    • 9.11.0+~cs9.9.16-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →