CVE-2024-39691: Malicious Matrix homeserver can leak truncated message content of messages it shouldn't have access to in matrix-appservice-irc
Summary
CVE-2024-39691: Malicious Matrix homeserver can leak truncated message content of messages it shouldn't have access to. Affects matrix-appservice-irc versions < 2.0.1. Fixed in 2.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
matrix-appservice-irc is an npm package that provides a bridge between Matrix and IRC networks, allowing users to communicate between the two platforms. It relies on the Matrix homeserver-provided timestamp to determine user access to events. However, a vulnerability in versions before 2.0.1 allows a malicious Matrix homeserver to fabricate timestamps and trick the bridge into leaking room messages that the homeserver should not have access to.
Vulnerability Detail
The vulnerability in matrix-appservice-irc versions before 2.0.1 allows a malicious Matrix homeserver to manipulate timestamps and gain access to room messages it shouldn't have. This can lead to unauthorized disclosure of sensitive information. The fix in version 2.0.1 removes the reliance on origin_server_ts and tracks event timestamps internally to prevent this issue.
How To Fix
Latest published version: 0.36.1 as of 23 Oct 2026
npm install matrix-appservice-irc@0.36.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.1
This is the first release that contains the fix.
npm install matrix-appservice-irc@2.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, a temporary workaround is to limit the information leaked by setting a reply template that doesn't contain the original message. This can be done by modifying the configuration file of matrix-appservice-irc. Refer to the following lines in the configuration file for guidance: config.sample.yaml#L601-L604
Conclusion
The vulnerability in matrix-appservice-irc versions before 2.0.1 allows a malicious Matrix homeserver to leak truncated message content of messages it shouldn't have access to. Upgrading to version 2.0.1 or later is recommended to fix the vulnerability. In the meantime, limiting the leaked information through a workaround can provide temporary mitigation.
See every vulnerability recorded for matrix-appservice-irc →
FAQ
matrix-appservice-irc is an npm package that acts as a bridge between Matrix and IRC networks, enabling communication between the two platforms.
The vulnerability allows a malicious Matrix homeserver to gain access to room messages it shouldn't have, potentially leading to unauthorized disclosure of sensitive information.
To fix the vulnerability, upgrade to matrix-appservice-irc version 2.0.1 or later.
Yes, a temporary workaround is to limit the information leaked by modifying the reply template in the configuration file of matrix-appservice-irc.
More information about the patch can be found in the following GitHub pull request: https://github.com/matrix-org/matrix-appservice-irc/pull/1804
References
Related vulnerabilities
Recent vulnerabilities recorded for matrix-appservice-irc.
