HarborGuard / CVE
Back to search
CRITICALCVE-2026-23966Published Modified CNA GitHub_M

CVE-2026-23966: sm-crypto Affected by Private Key Recovery in SM2-PKE

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A private key recovery vulnerability exists in the SM2 decryption logic of sm-crypto prior to version 0.3.14. By interacting with the SM2 decryption interface multiple times, an attacker can fully recover the private key within approximately several hundred interactions. Version 0.3.14 patches the issue.

Metrics

CVSS v3.1
9.1
Severity
CRITICAL
Fixed in
—
Affected Products
1
Affected packages
  • JuneAndGreen / sm-crypto
    < 0.3.14
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References