Vulnerability · Published Jan 22, 2026 · Assigned by GitHub_M
CVE-2026-23966sm-crypto Affected by Private Key Recovery in SM2-PKE
Critical 9.1
In plain English
A critical-severity insufficient verification of data authenticity in sm-crypto from JuneAndGreen. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A private key recovery vulnerability exists in the SM2 decryption logic of sm-crypto prior to version 0.3.14. By interacting with the SM2 decryption interface multiple times, an attacker can fully recover the private key within approximately several hundred interactions. Version 0.3.14 patches the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | sm-crypto | 0.3.14 | GHSA-pgx9-497m-6c4v |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| JuneAndGreen | sm-crypto | < 0.3.14 |
Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N