CVE-2026-23966: sm-crypto Affected by Private Key Recovery in SM2-PKE
Summary A private key recovery vulnerability exists in the SM2 decryption logic of sm-crypto. By interacting with the SM2 decryption interface multiple times, an attacker can fully recover the private key within approximately several hundred interactions. Credit This vulnerability was discovered by: - XlabAI Team of Tencent Xuanwu Lab - Atuin Automated Vulnerability Discovery Engine
Published Jan 21, 2026 · Updated Jan 22, 2026
Affected packages
sm-crypto
- Ecosystem
- npm
- Affected
- < 0.3.14
- Fixed in
- 0.3.14
- Check
npm ls sm-crypto
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Summary
A private key recovery vulnerability exists in the SM2 decryption logic of sm-crypto. By interacting with the SM2 decryption interface multiple times, an attacker can fully recover the private key within approximately several hundred interactions.
Credit
This vulnerability was discovered by:
- XlabAI Team of Tencent Xuanwu Lab
- Atuin Automated Vulnerability Discovery Engine
Credited to XlabAITeam, A7um, tl2cents, keenanwgn.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology