CVE-2024-42369 - CVE House
Back to Database
Status published Medium CVE-2024-42369

A room with itself as a its predecessor will freeze matrix-js-sdk

Vulnerability Description

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk's getRoomUpgradeHistory function will infinitely recurse in this case, causing the code to hang. This method is public but also called by the 'leaveRoomChain()' method, so leaving a room will also trigger the bug. This was patched in matrix-js-sdk 34.3.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-42369

Credits & Attribution

No credits recorded in the NVD database.

References

More from matrix-org

View All →
CVE-2025-66622
matrix-sdk-base is vulnerable to DoS via custom m.room.join_rules event values
Low 1.3
CVE-2025-59160
matrix-js-sdk has insufficient validation when considering a room to be upgraded by another
Low 2.7
CVE-2025-59047
matrix-sdk-base has panic in the `RoomMember::normalized_power_level()` method
Low 2.7
CVE-2025-53549
Matrix Rust SDK allows SQL injection in the EventCache implementation
Medium 5.2
CVE-2025-48937
matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator
Medium 4.9

Affected Vendor

Affected Software

matrix-js-sdk
Vulnerable Versions:
< 34.3.1

Timeline

Official Publish: August 20th, 2024
Last Modified: September 3rd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L

Weaknesses (CWE)

CWE-674

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.