CVE-2026-23967
📋 TL;DR
A signature malleability vulnerability in sm-crypto's SM2 signature verification allows attackers to create new valid signatures from existing ones. This affects applications using sm-crypto for Chinese cryptographic algorithm implementations before version 0.3.14. Attackers could potentially forge signatures to bypass authentication or authorization checks.
💻 Affected Systems
- sm-crypto
📦 What is this software?
Sm Crypto by Juneandgreen
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of systems relying on SM2 signatures for authentication, allowing unauthorized access, data manipulation, or privilege escalation.
Likely Case
Signature forgery enabling bypass of signature-based verification mechanisms in applications using sm-crypto.
If Mitigated
Limited impact if additional verification layers exist or if SM2 signatures aren't used for critical security decisions.
🎯 Exploit Status
Exploitation requires understanding of SM2 signature malleability and access to existing signatures.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.3.14
Vendor Advisory: https://github.com/JuneAndGreen/sm-crypto/security/advisories/GHSA-qv7w-v773-3xqm
Restart Required: No
Instructions:
Update sm-crypto dependency to version 0.3.14 or later
Run: npm update sm-crypto
Test SM2 signature verification functionality
🔧 Temporary Workarounds
Implement additional signature verification
allAdd custom validation logic to check signature uniqueness beyond standard SM2 verification
🧯 If You Can't Patch
- Disable SM2 signature functionality if not essential
- Implement additional authentication layers for signature-protected operations
🔍 How to Verify
Check if Vulnerable:
Check package.json or node_modules for sm-crypto version <0.3.14Check Version:
npm list sm-cryptoVerify Fix Applied:
Confirm sm-crypto version is 0.3.14 or higher in package.json📡 Detection & Monitoring
Log Indicators:
- Multiple successful signature verifications for same message with different signatures
- Unexpected signature validation patterns
Network Indicators:
- Unusual authentication attempts using SM2 signatures
SIEM Query:
Search for application logs containing SM2 signature verification anomalies