CVE-2022-39203: Parsing issue in matrix-org/node-irc leading to room takeovers
Summary
CVE-2022-39203: Parsing issue in matrix-org/node-irc leading to room takeovers. Affects matrix-appservice-irc versions < 0.35.0. Fixed in 0.35.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is matrix-appservice-irc, an npm package. It is a bridge between Matrix and IRC, allowing users to communicate between the two platforms. The package facilitates the bridging of channels, enabling users to join and interact with IRC channels through Matrix. However, a parsing issue in the package can lead to room takeovers, granting attackers unauthorized permissions in the channel.
Vulnerability Detail
The vulnerability arises from a specific string of characters that can confuse the bridge, causing it to combine an attacker-owned channel with an existing channel. This combination allows the attacker to gain permissions in the channel, potentially leading to unauthorized actions and compromising the integrity of the communication. The impact of this vulnerability is significant, as it enables attackers to manipulate the bridging functionality and exploit the system.
How To Fix
Latest published version: 0.36.1 as of 23 Oct 2026
npm install matrix-appservice-irc@0.36.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.35.0
This is the first release that contains the fix.
npm install matrix-appservice-irc@0.35.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, a workaround is available. By disabling dynamic channel joining via the dynamicChannels.enabled configuration option, users are prevented from joining new channels. This effectively restricts the bridging functionality to existing channels and those specified in the configuration, reducing the attack surface and minimizing the risk of room takeovers.
Conclusion
In conclusion, the matrix-appservice-irc package is vulnerable to a parsing issue that can result in room takeovers. It is crucial to update the package to version 0.35.0 or later to mitigate this vulnerability. Alternatively, disabling dynamic channel joining can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for matrix-appservice-irc →
FAQ
matrix-appservice-irc is an npm package that acts as a bridge between Matrix and IRC, enabling communication between the two platforms.
The vulnerability allows attackers to combine their own channel with an existing channel, granting them unauthorized permissions in the channel and potentially compromising communication integrity.
To fix the vulnerability, update the matrix-appservice-irc package to version 0.35.0 or later, which includes the necessary patch to address the parsing issue.
Yes, you can disable dynamic channel joining via the dynamicChannels.enabled configuration option to prevent users from joining new channels. This reduces the risk of room takeovers until the package can be updated.
The vulnerability was discovered and reported by Val Lorentz.
Related vulnerabilities
Recent vulnerabilities recorded for matrix-appservice-irc.
