matrix-js-sdk vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-59160Mediummatrix-js-sdk: matrix-js-sdk has insufficient validation when considering a room to be upgraded by another CVE-2024-50336Mediummatrix-js-sdk: matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal CVE-2024-47080Highmatrix-js-sdk: Matrix JavaScript SDK's key history sharing could share keys to malicious devices CVE-2024-42369Mediummatrix-js-sdk: matrix-js-sdk will freeze when a user sets a room with itself as a its predecessor CVE-2023-29529Mediummatrix-js-sdk: matrix-js-sdk vulnerable to invisible eavesdropping in group calls CVE-2023-28427Highmatrix-js-sdk: Prototype pollution in matrix-js-sdk (part 2)CVE-2022-36059Highmatrix-js-sdk: matrix-js-sdk Prototype Pollution vulnerability CVE-2022-39250Highmatrix-js-sdk: matrix-js-sdk subject to user impersonation due to key/device identifier confusion in SAS verification CVE-2022-39251Highmatrix-js-sdk: matrix-js-sdk subject to user spoofing via Olm/Megolm protocol confusion CVE-2022-39249Highmatrix-js-sdk: matrix-js-sdk subject to impersonated messages due to permissive key forwarding CVE-2022-39236Mediummatrix-js-sdk: Improper beacon events in matrix-js-sdk can result in availability issues CVE-2021-40823Mediummatrix-js-sdk: matrix-js-sdk can be tricked into disclosing E2EE room keys to a participating homeserver

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo