CVE-2022-36060: matrix-react-sdk Prototype pollution vulnerability
Summary
CVE-2022-36060: matrix-react-sdk Prototype pollution vulnerability. Affects matrix-react-sdk versions < 3.53.0. Fixed in 3.53.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The matrix-react-sdk is an npm package that provides a React-based SDK for building Matrix clients. It is used to develop applications that interact with the Matrix communication protocol, enabling real-time messaging and collaboration features. The package is widely used in various Matrix client applications.
Vulnerability Detail
The matrix-react-sdk is affected by a prototype pollution vulnerability (CVE-2022-36060). This vulnerability allows an attacker to manipulate the prototype of an object, leading to unexpected behavior and potential security issues. By sending specially crafted strings in key places, an attacker can disrupt or impede the functionality of the matrix-react-sdk. This can result in crashes of room or event tiles, rendering certain rooms or events inaccessible. Although the rest of the application may appear functional, the affected rooms or events will not be rendered properly.
How To Fix
Latest published version: 3.114.0 as of 23 Oct 2026
npm install matrix-react-sdk@3.114.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.53.0
This is the first release that contains the fix.
npm install matrix-react-sdk@3.53.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The matrix-react-sdk is affected by a prototype pollution vulnerability that can disrupt the rendering of certain rooms or events. To mitigate this vulnerability, it is crucial to upgrade to matrix-react-sdk version 3.53.0 or later. This upgrade will ensure the proper functioning of the matrix-react-sdk and protect against potential attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for matrix-react-sdk →
FAQ
The impact of this vulnerability is that certain rooms or events in the matrix-react-sdk may not be rendered properly, leading to crashes or inaccessibility. The rest of the application may appear functional, but the affected rooms or events will be disrupted.
No, there are no known workarounds for this vulnerability. The recommended solution is to upgrade to the latest version of matrix-react-sdk.
Prototype pollution is a vulnerability that occurs when an attacker can modify the prototype of an object, leading to unexpected behavior and potential security issues. In this case, the matrix-react-sdk is susceptible to prototype pollution, which can be exploited by sending specially crafted strings.
There is no known public exploit for this vulnerability at the moment. However, it is important to upgrade to the fixed version to prevent any potential attacks.
You can find more information about prototype pollution and its impact on JavaScript applications in the Snyk Learn lesson: Prototype Pollution in JavaScript (https://learn.snyk.io/lessons/prototype-pollution/javascript/).
Related vulnerabilities
Recent vulnerabilities recorded for matrix-react-sdk.
