# CVE-2024-42369: matrix-js-sdk infinite recursion in room upgrade history

Source: https://junglewise.ai/threats/cve-2024-42369-matrix-js-sdk-infinite-recursion-in-room-upgrade-history  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-42369 · Severity: low · CVSS 3.1 · Published 2024-08-20

matrix-js-sdk is a JavaScript library used by Matrix chat applications to manage rooms and user interactions. A malicious Matrix server can craft a room configuration that creates a cycle in the room predecessor chain, causing the library's room upgrade history function to infinitely loop and freeze the application. This affects any user attempting to leave such a room or query its upgrade history, disrupting service availability.

Technologies: [matrix-js-sdk (npm)](https://junglewise.ai/threats/technologies/matrix-js-sdk). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2024-42369 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-42369 being exploited in the wild.

**How severe is CVE-2024-42369?** Low severity, with a CVSS score of 3.1, published 20 August 2024.

**Which products and versions are affected?** matrix-js-sdk (npm) SEMVER:introduced=0,fixed=34.3.1.

**Is there a fix for CVE-2024-42369?** Yes. matrix-js-sdk (npm): upgrade to 34.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-42369 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-42369?** Check whether you run matrix-js-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- matrix-js-sdk (npm): upgrade to 34.3.1 or later

  ```sh
  npm install matrix-js-sdk@34.3.1
  ```


## Technical details

The vulnerability is an uncontrolled recursion (CWE-674) in the getRoomUpgradeHistory function, which traverses a room's predecessor chain without cycle detection. A malicious homeserver can create a room structure where a room references itself as its own predecessor, causing infinite recursion and application hang. The leaveRoomChain method internally calls getRoomUpgradeHistory, so leaving a room can trigger the bug. Exploitation requires a malicious homeserver and user interaction (viewing/leaving the crafted room). The vulnerability was patched in matrix-js-sdk version 34.3.1.

## Affected products

- matrix-org matrix-js-sdk <34.3.1

## Identifiers

- CVE-2024-42369
- GHSA-vhr5-g3pm-49fm

## Timeline

- 2024-08-20: disclosed
- 2024-08-20: patched: matrix-js-sdk 34.3.1

## References

- [https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-vhr5-g3pm-49fm](https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-vhr5-g3pm-49fm)

## Related threats

- [matrix-js-sdk insufficient validation in room upgrade handling](https://junglewise.ai/threats/cve-2025-59160-matrix-js-sdk-insufficient-validation-in-room-upgrade-handling)
- [matrix-js-sdk MXC URI path traversal](https://junglewise.ai/threats/cve-2024-50336-matrix-js-sdk-mxc-uri-path-traversal)
- [Matrix JavaScript SDK key history sharing vulnerability](https://junglewise.ai/threats/cve-2024-47080-matrix-javascript-sdk-key-history-sharing-vulnerability)
- [matrix-js-sdk unauthorized eavesdropping in group calls](https://junglewise.ai/threats/cve-2023-29529-matrix-js-sdk-unauthorized-eavesdropping-in-group-calls)
- [matrix-js-sdk prototype pollution (part 2)](https://junglewise.ai/threats/cve-2023-28427-matrix-js-sdk-prototype-pollution-part-2)