CVE-2026-23967 sm-crypto Affected by Signature Malleability in SM2-DSA
Attackers can create alternative valid signatures for signed messages, bypassing integrity checks in applications using the sm-crypto library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23967?
CVE-2026-23967 is a high-severity vulnerability in JuneAndGreen sm-crypto, published on 22 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A signature malleability vulnerability exists in the SM2 signature verification logic of the sm-crypto library prior to version 0.3.14. An attacker can derive a new valid signature for a previously signed message from an existing signature. Version 0.3.14 patches the issue.
Weakness: CWE-347
Which versions are affected by CVE-2026-23967?
2 open source packages ship an affected version, including sm-crypto. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
sm-crypto npm | All versions | 0.3.14 |
sm-crypto npm | All versions | 0.3.14 |
Products include Juneandgreen Sm-Crypto.
How do I fix CVE-2026-23967?
Upgrade sm-crypto to 0.3.14 or later.
Is CVE-2026-23967 being exploited?
There is no known exploitation of CVE-2026-23967 in the wild and no public exploit code.
Other vulnerabilities in JuneAndGreen sm-crypto
Sources
Also known as GHSA-qv7w-v773-3xqm.