CVE-2026-23966
📋 TL;DR
A private key recovery vulnerability exists in sm-crypto's SM2 decryption implementation, allowing attackers to fully extract private keys through several hundred decryption interactions. This affects any application using sm-crypto versions before 0.3.14 for SM2 cryptographic operations. The vulnerability enables complete compromise of encrypted communications and digital signatures.
💻 Affected Systems
- sm-crypto
📦 What is this software?
Sm Crypto by Juneandgreen
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of all SM2-encrypted communications and digital signatures, leading to data theft, impersonation, and system takeover.
Likely Case
Attackers extract private keys from vulnerable systems, decrypt sensitive data, forge signatures, and impersonate legitimate users or services.
If Mitigated
With proper network segmentation and monitoring, impact is limited to specific services using vulnerable sm-crypto versions.
🎯 Exploit Status
Exploitation requires ability to interact with SM2 decryption interface, but the attack itself is straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.3.14
Vendor Advisory: https://github.com/JuneAndGreen/sm-crypto/security/advisories/GHSA-pgx9-497m-6c4v
Restart Required: No
Instructions:
1. Update sm-crypto to version 0.3.14 or later using npm update sm-crypto. 2. Verify the update completed successfully. 3. Test SM2 functionality to ensure compatibility.
🔧 Temporary Workarounds
Disable SM2 Decryption
allTemporarily disable SM2 decryption functionality if not critically required
Rate Limit Decryption Requests
allImplement strict rate limiting on SM2 decryption endpoints to prevent the several hundred interactions needed for exploitation
🧯 If You Can't Patch
- Isolate systems using vulnerable sm-crypto versions behind strict network controls
- Implement comprehensive monitoring for unusual decryption request patterns
🔍 How to Verify
Check if Vulnerable:
Check package.json or run npm list sm-crypto to see if version is below 0.3.14Check Version:
npm list sm-crypto | grep sm-cryptoVerify Fix Applied:
Confirm sm-crypto version is 0.3.14 or higher using npm list sm-crypto📡 Detection & Monitoring
Log Indicators:
- Unusually high volume of SM2 decryption requests from single source
- Multiple failed decryption attempts with similar parameters
Network Indicators:
- Repeated SM2 decryption API calls from external sources
- Pattern of hundreds of decryption requests within short timeframes
SIEM Query:
source="application_logs" AND (message="SM2 decrypt" OR message="sm-crypto") AND count > 100 within 5 minutes