# CVE-2025-59160: matrix-js-sdk insufficient validation in room upgrade handling

Source: https://junglewise.ai/threats/cve-2025-59160-matrix-js-sdk-insufficient-validation-in-room-upgrade-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-09-16. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-59160 · Severity: medium · CVSS 4 · Published 2025-09-16

matrix-js-sdk is a JavaScript library used by Matrix chat applications to manage rooms and conversations. An attacker can exploit insufficient validation of room predecessor links to trick an application into replacing a closed room with an attacker-controlled room, potentially causing users to join the wrong conversation or lose chat history continuity.

Technologies: [matrix-js-sdk (npm)](https://junglewise.ai/threats/technologies/matrix-js-sdk). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-59160 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-59160 being exploited in the wild.

**How severe is CVE-2025-59160?** Medium severity, with a CVSS score of 4, published 16 September 2025.

**Which products and versions are affected?** matrix-js-sdk (npm) SEMVER:introduced=0,fixed=38.2.0.

**Is there a fix for CVE-2025-59160?** Yes. matrix-js-sdk (npm): upgrade to 38.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-59160 attacked?** It is attacked over the network.

**Am I affected by CVE-2025-59160?** Check whether you run matrix-js-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- matrix-js-sdk (npm): upgrade to 38.2.0 or later

  ```sh
  npm install matrix-js-sdk@38.2.0
  ```


## Technical details

The vulnerability exists in the MatrixClient::getJoinedRooms method due to insufficient validation of room predecessor links when determining if a room has been upgraded. An attacker can supply a crafted room predecessor link to replace a tombstoned (closed) room with an unrelated attacker-supplied room. The attack is network-reachable and requires no authentication or user interaction. Successful exploitation allows a remote attacker to manipulate room upgrade logic, potentially redirecting users to malicious rooms. The issue is patched in version 38.2.0; users can also work around it by using getRooms() and manually filtering upgraded rooms instead of relying on getJoinedRooms.

## Affected products

- Matrix.org matrix-js-sdk before 38.2.0

## Identifiers

- CVE-2025-59160
- GHSA-mp7c-m3rh-r56v

## Timeline

- 2025-09-16: disclosed
- 2025-09-16: patched: version 38.2.0 released

## References

- [https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mp7c-m3rh-r56v](https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mp7c-m3rh-r56v)

## Related threats

- [matrix-js-sdk MXC URI path traversal](https://junglewise.ai/threats/cve-2024-50336-matrix-js-sdk-mxc-uri-path-traversal)
- [Matrix JavaScript SDK key history sharing vulnerability](https://junglewise.ai/threats/cve-2024-47080-matrix-javascript-sdk-key-history-sharing-vulnerability)
- [matrix-js-sdk infinite recursion in room upgrade history](https://junglewise.ai/threats/cve-2024-42369-matrix-js-sdk-infinite-recursion-in-room-upgrade-history)
- [matrix-js-sdk unauthorized eavesdropping in group calls](https://junglewise.ai/threats/cve-2023-29529-matrix-js-sdk-unauthorized-eavesdropping-in-group-calls)
- [matrix-js-sdk prototype pollution (part 2)](https://junglewise.ai/threats/cve-2023-28427-matrix-js-sdk-prototype-pollution-part-2)