sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A private key recovery vulnerability exists in the SM2 …

Published:

21 januari 2026 om 23:00:00

Alert date:

22 januari 2026 om 04:02:57

Source:

nvd.nist.gov

Supply Chain & Dependencies, Web Technologies

A critical private key recovery vulnerability exists in the sm-crypto JavaScript library prior to version 0.3.14. The vulnerability affects the SM2 decryption logic implementation of Chinese cryptographic algorithms SM2, SM3, and SM4. Attackers can fully recover private keys by interacting with the SM2 decryption interface multiple times, requiring only several hundred interactions to complete the attack. The vulnerability has been patched in version 0.3.14 of the sm-crypto library.

Technical details

Mitigation steps:

Affected products:

sm-crypto