CVE-2026-23966criticalCWE-345

CVE-2026-23966: critical vulnerability in JuneAndGreen sm-crypto

sm-crypto Affected by Private Key Recovery in SM2-PKE

Published

Follow this CVE+ Monitor sm-crypto+ Monitor sm-crypto

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.1epss 0.2%
sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A private key recovery vulnerability exists in the SM2 decryption logic of sm-crypto prior to version 0.3.14. By interacting with the SM2 decryption interface multiple times, an attacker can fully recover the private key within approximately several hundred interactions. Version 0.3.14 patches the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
JuneAndGreen · sm-crypto
Related CVEs — JuneAndGreen sm-crypto

In the same product, most dangerous first.

CVE-2026-73567CRITICALsm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clockEPSS 0.4%CVE-2026-23965HIGHsm-crypto Affected by Signature Forgery in SM2-DSAEPSS 0.2%CVE-2026-23967HIGHsm-crypto Affected by Signature Malleability in SM2-DSAEPSS 0.2%