# CVE-2022-39249: matrix-js-sdk message impersonation via permissive key forwarding

Source: https://junglewise.ai/threats/cve-2022-39249-matrix-js-sdk-message-impersonation-via-permissive-key-forwarding  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-09-30. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-39249 · Severity: low · CVSS 3.1 · Published 2022-09-30

matrix-js-sdk is a JavaScript client library for the Matrix messaging protocol, used by many popular encrypted chat applications. The library incorrectly accepted encrypted message keys from any source, allowing an attacker cooperating with a malicious Matrix server to forge messages appearing to come from other users. While such forged messages display a warning shield on some platforms, this protection may be missing or ineffective on others.

Technologies: [matrix-js-sdk (npm)](https://junglewise.ai/threats/technologies/matrix-js-sdk). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-39249 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-39249 being exploited in the wild.

**How severe is CVE-2022-39249?** Low severity, with a CVSS score of 3.1, published 30 September 2022.

**Which products and versions are affected?** matrix-js-sdk (npm) SEMVER:introduced=0,fixed=19.7.0.

**Is there a fix for CVE-2022-39249?** Yes. matrix-js-sdk (npm): upgrade to 19.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-39249 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-39249?** Check whether you run matrix-js-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- matrix-js-sdk (npm): upgrade to 19.7.0 or later

  ```sh
  npm install matrix-js-sdk@19.7.0
  ```


## Technical details

This vulnerability affects the key forwarding mechanism in matrix-js-sdk, which normally allows clients to recover encrypted messages they missed (e.g., when accessing chat history or after network errors). The SDK implemented an overly permissive policy by accepting forwarded encryption keys from untrusted sources without sufficient validation. An attacker colluding with a malicious homeserver can exploit this to send specially crafted Megolm session keys, allowing them to construct messages that appear to originate from legitimate users. The fix tightens the forwarding policy to only accept keys in response to explicit requests and only from the user's own verified devices. Additionally, a "trusted" flag is now set on decrypted messages to indicate key source trustworthiness, requiring clients to display appropriate warnings for untrusted keys. The vulnerability was patched in matrix-js-sdk v19.7.0 released on 2022-09-28.

## Affected products

- matrix-org matrix-js-sdk all versions before 19.7.0

## Identifiers

- CVE-2022-39249
- GHSA-6263-x97c-c4gg

## Timeline

- 2022-09-28: disclosed
- 2022-09-28: patched: matrix-js-sdk v19.7.0 released

## References

- [https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-6263-x97c-c4gg](https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-6263-x97c-c4gg)
- [https://github.com/matrix-org/matrix-spec-proposals/pull/3061](https://github.com/matrix-org/matrix-spec-proposals/pull/3061)
- [https://github.com/matrix-org/matrix-js-sdk/commit/a587d7c36026fe1fcf93dfff63588abee359be76](https://github.com/matrix-org/matrix-js-sdk/commit/a587d7c36026fe1fcf93dfff63588abee359be76)
- [https://github.com/matrix-org/matrix-js-sdk](https://github.com/matrix-org/matrix-js-sdk)
- [https://github.com/matrix-org/matrix-js-sdk/releases/tag/v19.7.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v19.7.0)
- [https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients](https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients)

## Related threats

- [matrix-js-sdk insufficient validation in room upgrade handling](https://junglewise.ai/threats/cve-2025-59160-matrix-js-sdk-insufficient-validation-in-room-upgrade-handling)
- [matrix-js-sdk MXC URI path traversal](https://junglewise.ai/threats/cve-2024-50336-matrix-js-sdk-mxc-uri-path-traversal)
- [Matrix JavaScript SDK key history sharing vulnerability](https://junglewise.ai/threats/cve-2024-47080-matrix-javascript-sdk-key-history-sharing-vulnerability)
- [matrix-js-sdk infinite recursion in room upgrade history](https://junglewise.ai/threats/cve-2024-42369-matrix-js-sdk-infinite-recursion-in-room-upgrade-history)
- [matrix-js-sdk unauthorized eavesdropping in group calls](https://junglewise.ai/threats/cve-2023-29529-matrix-js-sdk-unauthorized-eavesdropping-in-group-calls)