CVE-2026-23967: sm-crypto Signature Malleability Vulnerability
Summary
CVE-2026-23967: sm-crypto Affected by Signature Malleability in SM2-DSA. Affects sm-crypto versions < 0.3.14. Fixed in 0.3.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The sm-crypto library is a JavaScript implementation of cryptographic algorithms, primarily used for secure communications and data integrity. It provides functionalities for various cryptographic operations, including digital signatures, encryption, and decryption. However, the library is susceptible to a signature malleability vulnerability in its SM2 signature verification logic, which can lead to security issues if exploited.
Vulnerability Detail
A signature malleability vulnerability exists in the SM2 signature verification logic of the sm-crypto library. This vulnerability allows an attacker to derive a new valid signature for a previously signed message from an existing signature. The implications of this vulnerability are significant, as it can undermine the integrity of signed messages, potentially allowing attackers to impersonate legitimate users or alter the intended message without detection.
How To Fix
Minimum fixed version
0.3.14
This is the first release that contains the fix.
npm install sm-crypto@0.3.14Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to update the package immediately, consider implementing additional validation checks on signatures to mitigate the risk of signature malleability. However, this is not a complete solution and should only be a temporary measure until the package can be updated.
Conclusion
The sm-crypto library is affected by a significant signature malleability vulnerability that can compromise the integrity of signed messages. It is crucial to update to version 0.3.14 or later to mitigate this risk. Users should also consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for sm-crypto →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The risks include the potential for attackers to create valid signatures for messages, which can lead to impersonation and message integrity issues.
Yes, version 0.3.14 and later of sm-crypto contains the fix for this vulnerability.
Implement additional validation checks on signatures as a temporary workaround until you can update to the patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for sm-crypto.
