p PatchFirst

CVE-2026-23966

CVE-2026-23966 · sm-crypto Affected by Private Key Recovery in SM2-PKE

This page contains facts from public vulnerability sources. Check the original advisory before updating.

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A private key recovery vulnerability exists in the SM2 decryption logic of sm-crypto prior to version 0.3.14. By interacting with the SM2 decryption interface multiple times, an attacker can fully recover the private key within approximately several hundred interactions. Version 0.3.14 patches the issue.

CVSS 9.1 · Critical · EPSS 0.2% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • sm-crypto

    Versions
    • < 0.3.14: Affected

    No fix published

  • sm-crypto npm

    Affected ranges
    • SEMVER: < 0.3.14

    Update to 0.3.14

Original sources

Check your server →