p PatchFirst

CVE-2026-23967

CVE-2026-23967 · sm-crypto Affected by Signature Malleability in SM2-DSA

This page contains facts from public vulnerability sources. Check the original advisory before updating.

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A signature malleability vulnerability exists in the SM2 signature verification logic of the sm-crypto library prior to version 0.3.14. An attacker can derive a new valid signature for a previously signed message from an existing signature. Version 0.3.14 patches the issue.

CVSS 7.5 · High · EPSS 0.2% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • sm-crypto

    Versions
    • < 0.3.14: Affected

    No fix published

  • sm-crypto npm

    Affected ranges
    • SEMVER: < 0.3.14

    Update to 0.3.14

Original sources

Check your server →