CVE-2021-32659: matrix-appservice-bridge - Automatic Room Upgrade Handling Vulnerability
Summary
CVE-2021-32659: Automatic room upgrade handling can be used maliciously to bridge a room non-consentually. Affects matrix-appservice-bridge versions < 2.6.1. Fixed in 2.6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The matrix-appservice-bridge package is an npm package used for bridging communication between Matrix and other chat platforms. It allows users to connect Matrix rooms with rooms in other chat platforms, enabling seamless communication between different platforms. The package provides functionality for handling room upgrades, which involves unbridging the current room and bridging into a target room when a 'm.room.tombstone' event is encountered. However, a vulnerability exists in versions prior to 2.6.1 that allows a malicious admin to redirect traffic to a different room without the new room being aware.
Vulnerability Detail
The vulnerability arises from the lack of verification in the target room's 'm.room.create' event. When a bridge encounters a 'm.room.tombstone' event, it unbridges the current room and bridges into the target room specified in the event. However, the package does not check if the 'predecessor' field in the target room's 'm.room.create' event contains the previous room. This allows a malicious admin to repoint the traffic to a different room without the new room being aware. This can lead to unauthorized access, data leakage, or disruption of communication between platforms.
How To Fix
Latest published version: 12.0.1 as of 23 Oct 2026
npm install matrix-appservice-bridge@12.0.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.6.1
This is the first release that contains the fix.
npm install matrix-appservice-bridge@2.6.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, a workaround is available by disabling the automatic room upgrade handling. This can be done by removing the 'roomUpgradeOpts' key from the 'Bridge' class options when instantiating a new 'Bridge' instance. Here is an example of how to remove the 'roomUpgradeOpts' key:
// Before
const bridge = new Bridge({
roomUpgradeOpts: {
// room upgrade options
},
});
// After
const bridge = new Bridge({
// other options
});
Conclusion
The matrix-appservice-bridge package prior to version 2.6.1 is vulnerable to an automatic room upgrade handling issue that can be exploited by a malicious admin to redirect traffic to a different room without the new room being aware. It is recommended to update the package to version 2.6.1 or greater to mitigate this vulnerability. If immediate update is not possible, the automatic room upgrade handling can be disabled as a workaround. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for matrix-appservice-bridge →
FAQ
The vulnerability allows a malicious admin of a bridged room to redirect traffic to a different room without the new room being aware. This can lead to unauthorized access, data leakage, or disruption of communication between platforms.
To fix this vulnerability, update the matrix-appservice-bridge package to version 2.6.1 or greater.
Yes, you can disable the automatic room upgrade handling by removing the 'roomUpgradeOpts' key from the 'Bridge' class options.
There are no known exploits of this vulnerability at the moment.
For more information, you can refer to the official patch at https://github.com/matrix-org/matrix-appservice-bridge/pull/330
References
Related vulnerabilities
Recent vulnerabilities recorded for matrix-appservice-bridge.
