GHSA-jx97-gwvc-pfxx: 
JavaScript vulnerability analysis and mitigation

Impact

In matrix-js-sdk 45.0.0 and earlier, the evaluation of some glob patterns could cause catastrophic regex backtracking. Exploiting that, a malicious homeserver owner could cause a DoS on a client (using the matrix-js-sdk) of one of its users by including a malicious push rule glob pattern in a /sync response; and a malicious administrator of an m.ignore.invites room that a user has subscribed to could cause a DoS by specifying a malicious pattern in a rule.

Patches

Patched in matrix-js-sdk 45.1.0.