CVE-2026-23965: Signature Forgery Vulnerability in sm-crypto Package
Summary
CVE-2026-23965: sm-crypto Affected by Signature Forgery in SM2-DSA. Affects sm-crypto versions < 0.4.0. Fixed in 0.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
sm-crypto is a cryptographic library for JavaScript that implements the SM2, SM3, and SM4 cryptographic algorithms. It is widely used in applications requiring secure data transmission and storage. The library is designed to provide developers with a straightforward interface for implementing cryptographic functions, but it has been found to have a significant vulnerability in its signature verification logic.
Vulnerability Detail
A signature forgery vulnerability exists in the SM2 signature verification logic of the sm-crypto package. This flaw allows an attacker to forge valid signatures for arbitrary public keys under default configurations. If the message space has enough redundancy, the attacker can manipulate the prefix of the message associated with the forged signature to meet specific formatting requirements. This vulnerability poses a high risk as it can compromise the integrity of signed messages, leading to unauthorized access or data manipulation.
How To Fix
Minimum fixed version
0.4.0
This is the first release that contains the fix.
npm install sm-crypto@0.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the SM2 signature verification functionality until you can update to the patched version. Additionally, consider implementing additional validation checks on signatures to mitigate the risk of forgery.
Conclusion
The sm-crypto package has a critical vulnerability that allows for signature forgery, which can lead to severe security risks. It is essential to update to version 0.4.0 or later to mitigate this risk. Users are encouraged to utilize tools like Vulert for ongoing monitoring of vulnerabilities in their applications.
See every vulnerability recorded for sm-crypto →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By simply analyzing your package-lock.json file, Vulert provides real-time alerts. You can also check your application using the Vulert playground without any signup.
If exploited, this vulnerability can allow attackers to forge signatures, compromising the integrity of signed messages and potentially leading to unauthorized access or data manipulation.
Yes, version 0.4.0 and later of the sm-crypto package contains the fix for this vulnerability and is safe to use.
If you cannot update the package right away, avoid using the SM2 signature verification functionality and implement additional validation checks on signatures as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for sm-crypto.
