Description
In certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the Object.prototype, disrupting matrix-js-sdk functionality, causing denial of service and potentially affecting program logic.
(This is part 2, where CVE-2022-36059 / GHSA-rfv9-x7hh-xc32 is part 1.
Recommendation
Update the matrix-js-sdk package to the latest compatible version. Followings are version details:
- Affected version(s): < 24.0.0
- Patched version(s): 24.0.0
References
- GHSA-mwq8-fjpf-c2gr
- matrix.org
- lists.debian.org
- www.debian.org
- security.gentoo.org
- CVE-2023-28427
- CWE-1321
- CAPEC-310
- OWASP 2021-A6
Related Issues
- counterpart vulnerable to prototype pollution - CVE-2025-57354
- Payload does not invalidate JWTs after log out - CVE-2025-4643
- Parse Server has an OAuth login vulnerability - CVE-2025-30168
- Use of Insufficiently Random Values in undici - CVE-2025-22150
- Tags:
- npm
- matrix-js-sdk
Anything's wrong? Let us know Last updated on May 30, 2023