# CVE-2022-36059: matrix-js-sdk prototype pollution in event processing

Source: https://junglewise.ai/threats/cve-2022-36059-matrix-js-sdk-prototype-pollution-in-event-processing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-03-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-36059 · Severity: low · CVSS 3.1 · Published 2023-03-28

matrix-js-sdk is a JavaScript library that enables applications to communicate using the Matrix protocol. A prototype pollution vulnerability allows attackers to inject malicious event data that can corrupt runtime data, disrupt the SDK's operation, or exclude information from being processed correctly. This could cause a Matrix client built on this library to malfunction, lose data, or stop responding to user actions.

Technologies: [matrix-js-sdk (npm)](https://junglewise.ai/threats/technologies/matrix-js-sdk). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-36059 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-36059 being exploited in the wild.

**How severe is CVE-2022-36059?** Low severity, with a CVSS score of 3.1, published 28 March 2023.

**Which products and versions are affected?** matrix-js-sdk (npm) SEMVER:introduced=0,fixed=19.4.0.

**Is there a fix for CVE-2022-36059?** Yes. matrix-js-sdk (npm): upgrade to 19.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-36059 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-36059?** Check whether you run matrix-js-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- matrix-js-sdk (npm): upgrade to 19.4.0 or later

  ```sh
  npm install matrix-js-sdk@19.4.0
  ```


## Technical details

The vulnerability is a prototype pollution flaw (CWE-1321) in matrix-js-sdk versions before 19.4.0 that allows modification of JavaScript object prototypes through specially crafted event data. An attacker can send events with special strings in key places that pollute the prototype chain, causing the SDK to exclude or corrupt runtime data. The attack is network-accessible, requires no authentication or user interaction, and can impact the availability and integrity of the SDK's data processing. The vulnerability is fixed in version 19.4.0. Workarounds include redacting affected events, restarting the client, or clearing storage, though some cases may not be fully recoverable without the patch.

## Affected products

- matrix-org matrix-js-sdk < 19.4.0

## Identifiers

- CVE-2022-36059
- GHSA-rfv9-x7hh-xc32

## Timeline

- 2023-03-28: disclosed
- 2023-03-28: patched: Fix available in version 19.4.0

## References

- [https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-rfv9-x7hh-xc32](https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-rfv9-x7hh-xc32)

## Related threats

- [matrix-js-sdk insufficient validation in room upgrade handling](https://junglewise.ai/threats/cve-2025-59160-matrix-js-sdk-insufficient-validation-in-room-upgrade-handling)
- [matrix-js-sdk MXC URI path traversal](https://junglewise.ai/threats/cve-2024-50336-matrix-js-sdk-mxc-uri-path-traversal)
- [Matrix JavaScript SDK key history sharing vulnerability](https://junglewise.ai/threats/cve-2024-47080-matrix-javascript-sdk-key-history-sharing-vulnerability)
- [matrix-js-sdk infinite recursion in room upgrade history](https://junglewise.ai/threats/cve-2024-42369-matrix-js-sdk-infinite-recursion-in-room-upgrade-history)
- [matrix-js-sdk unauthorized eavesdropping in group calls](https://junglewise.ai/threats/cve-2023-29529-matrix-js-sdk-unauthorized-eavesdropping-in-group-calls)