CVE catalog

CVE-2022-39236

element-web-1.11.8-1.1 on GA media

Severity: Unknown
Published: Sep 28, 2022, 5:15:00 PM UTC
Updated: Aug 27, 2026, 11:04:23 PM UTC
Source: [NVD] · [CVE record]
EPSS: 1.35% · Oct 22, 2026

Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Starting with version 17.1.0-rc.1, improperly formed beacon events can disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This is patched in matrix-js-sdk v19.7.0. Redacting applicable events, waiting for the sync processor to store data, and restarting the client are possible workarounds. Alternatively, redacting the applicable events and clearing all storage will fix the further perceived issues. Downgrading to an unaffected version, noting that such a version may be subject to other vulnerabilities, will additionally resolve the issue.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	node-matrix-js-sdk	11	`9.11.0+~cs9.9.16-1`	vulnerable
Debian	node-matrix-js-sdk	11	`9.11.0+~cs9.9.16-2`	vulnerable
Debian	node-matrix-js-sdk	11	`9.3.0+~cs9.9.16-2`	vulnerable
Debian	node-matrix-js-sdk	11	`9.7.0~~rc1+~cs9.9.16-1`	vulnerable
Debian	node-matrix-js-sdk	11	`9.7.0~~rc1+~cs9.9.16-2`	vulnerable
Ubuntu	thunderbird	18.04	`1:52.4.0+build1-0ubuntu2`	vulnerable
Ubuntu	thunderbird	18.04	`1:52.6.0+build1-0ubuntu1`	vulnerable
Ubuntu	thunderbird	18.04	`1:52.7.0+build1-0ubuntu1`	vulnerable
Ubuntu	thunderbird	18.04	`1:52.8.0+build1-0ubuntu0.18.04.1`	vulnerable
Ubuntu	thunderbird	18.04	`1:52.9.1+build3-0ubuntu0.18.04.1`	vulnerable
Ubuntu	thunderbird	18.04	`1:60.2.1+build1-0ubuntu0.18.04.2`	vulnerable
Ubuntu	thunderbird	18.04	`1:60.4.0+build2-0ubuntu0.18.04.1`	vulnerable
Ubuntu	thunderbird	18.04	`1:60.5.1+build2-0ubuntu0.18.04.1`	vulnerable
Ubuntu	thunderbird	18.04	`1:60.6.1+build2-0ubuntu0.18.04.1`	vulnerable
Ubuntu	thunderbird	18.04	`1:60.7.0+build1-0ubuntu0.18.04.1`	vulnerable
Ubuntu	thunderbird	18.04	`1:60.7.1+build1-0ubuntu0.18.04.1`	vulnerable
Ubuntu	thunderbird	18.04	`1:60.7.2+build2-0ubuntu0.18.04.1`	vulnerable
Ubuntu	thunderbird	18.04	`1:60.8.0+build1-0ubuntu0.18.04.1`	vulnerable
Ubuntu	thunderbird	18.04	`1:60.9.0+build1-0ubuntu0.18.04.1`	vulnerable
Ubuntu	thunderbird	18.04	`1:68.2.1+build1-0ubuntu0.18.04.1`	vulnerable
Ubuntu	thunderbird	18.04	`1:68.2.2+build1-0ubuntu0.18.04.1`	vulnerable
Ubuntu	thunderbird	18.04	`1:68.4.1+build1-0ubuntu0.18.04.1`	vulnerable
Ubuntu	thunderbird	18.04	`1:68.7.0+build1-0ubuntu0.18.04.1`	vulnerable
Ubuntu	thunderbird	18.04	`1:68.8.0+build2-0ubuntu0.18.04.2`	vulnerable
Ubuntu	thunderbird	18.04	`1:68.10.0+build1-0ubuntu0.18.04.1`	vulnerable
Ubuntu	thunderbird	18.04	`1:78.8.1+build1-0ubuntu0.18.04.1`	vulnerable
Ubuntu	thunderbird	18.04	`1:78.11.0+build1-0ubuntu0.18.04.2`	vulnerable
Ubuntu	thunderbird	18.04	`1:78.13.0+build1-0ubuntu0.18.04.1`	vulnerable
Ubuntu	thunderbird	18.04	`1:78.14.0+build1-0ubuntu0.18.04.1`	vulnerable
Ubuntu	thunderbird	18.04	`1:78.14.0+build1-0ubuntu0.18.04.2`	vulnerable
Ubuntu	thunderbird	18.04	`1:91.5.0+build1-0ubuntu0.18.04.1`	vulnerable
Ubuntu	thunderbird	18.04	`1:91.7.0+build2-0ubuntu0.18.04.1`	vulnerable
Ubuntu	thunderbird	18.04	`1:91.8.1+build1-0ubuntu0.18.04.1`	vulnerable
Ubuntu	thunderbird	18.04	`1:91.9.1+build1-0ubuntu0.18.04.1`	vulnerable
Ubuntu	thunderbird	18.04	`1:91.11.0+build2-0ubuntu0.18.04.1`	vulnerable
Ubuntu	thunderbird	18.04	`1:102.2.2+build1-0ubuntu0.18.04.1`	vulnerable
Ubuntu	thunderbird	18.04	`1:102.4.2+build2-0ubuntu0.18.04.1`	fixed
Ubuntu	thunderbird	20.04	`1:68.1.2+build1-0ubuntu1`	vulnerable
Ubuntu	thunderbird	20.04	`1:68.1.2+build1-0ubuntu2`	vulnerable
Ubuntu	thunderbird	20.04	`1:68.2.1+build1-0ubuntu1`	vulnerable
Ubuntu	thunderbird	20.04	`1:68.2.2+build1-0ubuntu1`	vulnerable
Ubuntu	thunderbird	20.04	`1:68.3.0+build2-0ubuntu1`	vulnerable
Ubuntu	thunderbird	20.04	`1:68.3.1+build1-0ubuntu2`	vulnerable
Ubuntu	thunderbird	20.04	`1:68.4.1+build1-0ubuntu1`	vulnerable
Ubuntu	thunderbird	20.04	`1:68.4.2+build2-0ubuntu1`	vulnerable
Ubuntu	thunderbird	20.04	`1:68.5.0+build1-0ubuntu1`	vulnerable
Ubuntu	thunderbird	20.04	`1:68.6.0+build2-0ubuntu1`	vulnerable
Ubuntu	thunderbird	20.04	`1:68.7.0+build1-0ubuntu1`	vulnerable
Ubuntu	thunderbird	20.04	`1:68.7.0+build1-0ubuntu2`	vulnerable
Ubuntu	thunderbird	20.04	`1:68.8.0+build2-0ubuntu0.20.04.2`	vulnerable
Ubuntu	thunderbird	20.04	`1:68.10.0+build1-0ubuntu0.20.04.1`	vulnerable
Ubuntu	thunderbird	20.04	`1:78.7.1+build1-0ubuntu0.20.04.1`	vulnerable
Ubuntu	thunderbird	20.04	`1:78.8.1+build1-0ubuntu0.20.04.1`	vulnerable
Ubuntu	thunderbird	20.04	`1:78.11.0+build1-0ubuntu0.20.04.2`	vulnerable
Ubuntu	thunderbird	20.04	`1:78.13.0+build1-0ubuntu0.20.04.2`	vulnerable
Ubuntu	thunderbird	20.04	`1:78.14.0+build1-0ubuntu0.20.04.1`	vulnerable
Ubuntu	thunderbird	20.04	`1:78.14.0+build1-0ubuntu0.20.04.2`	vulnerable
Ubuntu	thunderbird	20.04	`1:91.5.0+build1-0ubuntu0.20.04.1`	vulnerable
Ubuntu	thunderbird	20.04	`1:91.7.0+build2-0ubuntu0.20.04.1`	vulnerable
Ubuntu	thunderbird	20.04	`1:91.8.1+build1-0ubuntu0.20.04.1`	vulnerable
Ubuntu	thunderbird	20.04	`1:91.9.1+build1-0ubuntu0.20.04.1`	vulnerable
Ubuntu	thunderbird	20.04	`1:91.11.0+build2-0ubuntu0.20.04.1`	vulnerable
Ubuntu	thunderbird	20.04	`1:102.2.2+build1-0ubuntu0.20.04.1`	vulnerable
Ubuntu	thunderbird	20.04	`1:102.4.2+build2-0ubuntu0.20.04.1`	fixed
Ubuntu	node-matrix-js-sdk	20.04	`0.9.2-1`	vulnerable
Ubuntu	node-matrix-js-sdk	22.04	`9.3.0+~cs9.9.16-2`	vulnerable
Ubuntu	node-matrix-js-sdk	22.04	`9.11.0+~cs9.9.16-1`	vulnerable
Ubuntu	thunderbird	22.04	`1:91.1.2+build1-0ubuntu1`	vulnerable
Ubuntu	thunderbird	22.04	`1:91.3.0+build2-0ubuntu1`	vulnerable
Ubuntu	thunderbird	22.04	`1:91.3.1+build1-0ubuntu1`	vulnerable
Ubuntu	thunderbird	22.04	`1:91.3.2+build1-0ubuntu1`	vulnerable
Ubuntu	thunderbird	22.04	`1:91.4.0+build1.1-0ubuntu1`	vulnerable
Ubuntu	thunderbird	22.04	`1:91.4.0+build2-0ubuntu1`	vulnerable
Ubuntu	thunderbird	22.04	`1:91.5.0+build1-0ubuntu1`	vulnerable
Ubuntu	thunderbird	22.04	`1:91.5.1+build1-0ubuntu1`	vulnerable
Ubuntu	thunderbird	22.04	`1:91.6.1+build1-0ubuntu1`	vulnerable
Ubuntu	thunderbird	22.04	`1:91.7.0+build1-0ubuntu1`	vulnerable
Ubuntu	thunderbird	22.04	`1:91.7.0+build2-0ubuntu1`	vulnerable
Ubuntu	thunderbird	22.04	`1:91.8.0+build2-0ubuntu1`	vulnerable
Ubuntu	thunderbird	22.04	`1:91.9.1+build1-0ubuntu0.22.04.1`	vulnerable
Ubuntu	thunderbird	22.04	`1:91.11.0+build2-0ubuntu0.22.04.1`	vulnerable
Ubuntu	thunderbird	22.04	`1:102.2.2+build1-0ubuntu0.22.04.1`	vulnerable
Ubuntu	thunderbird	22.04	`1:102.4.2+build2-0ubuntu0.22.04.1`	fixed
Ubuntu	node-matrix-js-sdk	24.04	`9.11.0+~cs9.9.16-2`	vulnerable
Opensuse	element-desktop	tumbleweed	`1.11.8-1.1`	fixed
Opensuse	MozillaThunderbird	tumbleweed	`102.3.1-1.1`	fixed
Opensuse	element-web	tumbleweed	`1.11.8-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Ubuntu	thunderbird	deb	18.04	`1:102.4.2+build2-0ubuntu0.18.04.1`	Not reported	UBUNTU-CVE-2022-39236	Not reported
Ubuntu	thunderbird	deb	20.04	`1:102.4.2+build2-0ubuntu0.20.04.1`	Not reported	UBUNTU-CVE-2022-39236	Not reported
Ubuntu	thunderbird	deb	22.04	`1:102.4.2+build2-0ubuntu0.22.04.1`	Not reported	UBUNTU-CVE-2022-39236	Not reported
Opensuse	element-desktop	rpm	tumbleweed	`1.11.8-1.1`	Not reported	OPENSUSE-SU-2024:12374-1	Not reported
Opensuse	MozillaThunderbird	rpm	tumbleweed	`102.3.1-1.1`	Not reported	OPENSUSE-SU-2024:12379-1	Not reported
Opensuse	element-web	rpm	tumbleweed	`1.11.8-1.1`	Not reported	OPENSUSE-SU-2024:12375-1	Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[openSUSE Tumbleweed]

[MozillaThunderbird]Unknown
Source package: [MozillaThunderbird]
Details (1)
- 140.14.0-1.1 · x86_64 · tumbleweed
  Fixed · Fixed: 102.3.1-1.1
  pypi · MozillaThunderbird · opensuse · tumbleweed
[MozillaThunderbird-openpgp-librnp]Unknown
Source package: [MozillaThunderbird]
Details (1)
- 140.14.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 102.3.1-1.1
  Version impact unknown
  pypi · MozillaThunderbird · opensuse · tumbleweed
[MozillaThunderbird-translations-common]Unknown
Source package: [MozillaThunderbird]
Details (1)
- 140.14.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 102.3.1-1.1
  Version impact unknown
  pypi · MozillaThunderbird · opensuse · tumbleweed
[MozillaThunderbird-translations-other]Unknown
Source package: [MozillaThunderbird]
Details (1)
- 140.14.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 102.3.1-1.1
  Version impact unknown
  pypi · MozillaThunderbird · opensuse · tumbleweed

Observed: Oct 23, 2026, 6:29:36 PM UTC

References

[FIRST EPSS] · [OSV Package Vulnerability Database]