matrix-js-sdk vulnerable to invisible eavesdropping in group calls

Description

An attacker present in a room where an MSC3401 group call is taking place can eavesdrop on the video and audio of participants using matrix-js-sdk, without their knowledge. To affected matrix-js-sdk users, the attacker will not appear to be participating in the call.

Recommendation

Update the matrix-js-sdk package to the latest compatible version. Followings are version details:

• Affected version(s): < 24.1.0
• Patched version(s): 24.1.0

References

• GHSA-6g67-q39g-r79q
• CVE-2023-29529
• CWE-862
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• matrix-js-sdk has insufficient validation when considering a room to be upgraded by another - CVE-2025-59160
• @astrojs/node's trailing slash handling causes open redirect issue - CVE-2025-55207
• Linkify Allows Prototype Pollution & HTML Attribute Injection (XSS) - CVE-2025-8101
• Marked allows Regular Expression Denial of Service (ReDoS) attacks - CVE-2018-25110

Tags:

npm

matrix-js-sdk