CVE-2026-23966 sm-crypto Affected by Private Key Recovery in SM2-PKE
An attacker can recover the SM2 private key by interacting with the decryption interface multiple times, compromising cryptographic security.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23966?
CVE-2026-23966 is a critical vulnerability in JuneAndGreen sm-crypto, published on 22 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A private key recovery vulnerability exists in the SM2 decryption logic of sm-crypto prior to version 0.3.14. By interacting with the SM2 decryption interface multiple times, an attacker can fully recover the private key within approximately several hundred interactions. Version 0.3.14 patches the issue.
Weakness: CWE-345
Which versions are affected by CVE-2026-23966?
2 open source packages ship an affected version, including sm-crypto. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
sm-crypto npm | All versions | 0.3.14 |
sm-crypto npm | All versions | 0.3.14 |
Products include Juneandgreen Sm-Crypto.
How do I fix CVE-2026-23966?
Upgrade sm-crypto to 0.3.14 or later.
Is CVE-2026-23966 being exploited?
There is no known exploitation of CVE-2026-23966 in the wild and no public exploit code.
Other vulnerabilities in JuneAndGreen sm-crypto
Sources
Also known as GHSA-pgx9-497m-6c4v.