sm-crypto Affected by Private Key Recovery in SM2-PKE

緊急 9.1CVE-2026-23966 · GHSA-pgx9-497m-6c4v · 22/01/2026 公開 · 17/06/2026 更新

要点

CVE-2026-23966 は sm-crypto (juneandgreen), sm-crypto に影響する深刻度「緊急」 (CVSS 9.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.23%（全脆弱性の 14.1% より高い）。
対処：0.3.14 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
sm-crypto juneandgreen	`< 0.3.14`	`0.3.14`
sm-crypto npm	`< 0.3.14`	`0.3.14`

概要

Summary

A private key recovery vulnerability exists in the SM2 decryption logic of sm-crypto. By interacting with the SM2 decryption interface multiple times, an attacker can fully recover the private key within approximately several hundred interactions.

Credit

This vulnerability was discovered by:

XlabAI Team of Tencent Xuanwu Lab
Atuin Automated Vulnerability Discovery Engine

NVD の説明

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A private key recovery vulnerability exists in the SM2 decryption logic of sm-crypto prior to version 0.3.14. By interacting with the SM2 decryption interface multiple times, an attacker can fully recover the private key within approximately several hundred interactions. Version 0.3.14 patches the issue.