CVE-2026-23966: sm-crypto Private Key Recovery Vulnerability
Summary
CVE-2026-23966: sm-crypto Affected by Private Key Recovery in SM2-PKE. Affects sm-crypto versions < 0.3.14. Fixed in 0.3.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
sm-crypto is an npm package that provides cryptographic functions based on the Chinese SM2 standard, primarily used for public key encryption. It is designed to facilitate secure data transmission and storage. However, it has been found to contain a critical vulnerability that allows attackers to recover private keys through repeated interactions with the decryption interface.
Vulnerability Detail
A private key recovery vulnerability exists in the SM2 decryption logic of the sm-crypto package. This flaw allows an attacker to exploit the decryption interface by interacting with it multiple times, ultimately leading to the full recovery of the private key. The vulnerability stems from insufficient safeguards in the decryption process, making it susceptible to targeted attacks. The ramifications of this vulnerability are severe, as it compromises the confidentiality and integrity of encrypted data, potentially exposing sensitive information.
How To Fix
Minimum fixed version
0.3.14
This is the first release that contains the fix.
npm install sm-crypto@0.3.14Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should limit the number of interactions with the SM2 decryption interface and avoid using the affected version of the package until it has been updated. Additionally, consider using alternative cryptographic libraries that do not exhibit this vulnerability.
Conclusion
The sm-crypto package has a critical vulnerability that allows for private key recovery through repeated interactions with its decryption interface. Users are strongly advised to update to version 0.3.14 or later to protect against potential attacks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for sm-crypto →
FAQ
The CVSS score of this vulnerability is 9.1, indicating a critical level of severity.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The potential consequences include unauthorized access to sensitive data, loss of confidentiality, and compromise of cryptographic integrity.
This vulnerability was discovered by the XlabAI Team of Tencent Xuanwu Lab and the Atuin Automated Vulnerability Discovery Engine.
Yes, a patch is available in version 0.3.14 of the sm-crypto package. Users should update to this version to mitigate the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for sm-crypto.
