Inefficient regular expression complexity in Matrix Javascript SDK - #VU166055
Published: November 12, 2026
Vulnerability identifier: #VU166055
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-1333
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to cause a denial of service in clients using the Matrix JavaScript SDK.
The vulnerability exists due to inefficient regular expression complexity in glob pattern evaluation when processing push rules or m.ignore.invites policy rules. A remote privileged user can include a malicious push rule glob pattern in a homeserver /sync response or, as administrator of a policy room to which the victim subscribes, specify a malicious rule pattern to trigger catastrophic regex backtracking and deny client service.
Affected software
Matrix Javascript SDK
Remediation
Install security update from vendor's website.
Matrix Javascript SDK - update to 45.1.0