CVE-2022-39236
Matrix Javascript SDK improper beacon events can cause availability issues
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Starting with version 17.1.0-rc.1, improperly formed beacon events can disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This is patched in matrix-js-sdk v19.7.0. Redacting applicable events, waiting for the sync processor to store data, and restarting the client are possible workarounds. Alternatively, redacting the applicable events and clearing all storage will fix the further perceived issues. Downgrading to an unaffected version, noting that such a version may be subject to other vulnerabilities, will additionally resolve the issue.
Timeline
ID reserved
By GitHub_M
- 26 days later
· 26 days later
Published
- 3 years later
· 3 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | Medium4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
| NVDNVD · Modified | 3.1 | Medium5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
- EPSS (exploitation in 30 days)
- 1.4% · top 28% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.
Weakness
Affected products
- affected >= 17.1.0-rc.1, < 19.7.0
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- npmmatrix-js-sdkGHSA-hvv8-5v86-r45x (opens in a new tab)
References (5)
- https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-hvv8-5v86-r45x (opens in a new tab)x_transferred
- https://github.com/matrix-org/matrix-spec-proposals/pull/3488 (opens in a new tab)x_transferred
- https://github.com/matrix-org/matrix-js-sdk/commit/a587d7c36026fe1fcf93dfff63588abee359be76 (opens in a new tab)x_transferred
- https://github.com/matrix-org/matrix-js-sdk/releases/tag/v19.7.0 (opens in a new tab)x_transferred
- GLSA-202210-35 (opens in a new tab)vendor-advisoryx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-hvv8-5v86-r45x (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-39236)Record last updated .