CVE-2026-23966: Juneandgreen Sm-Crypto

Critical severity, CVSS 9.1. EPSS: 0.2% chance of exploitation in the next 30 days.

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A private key recovery vulnerability exists in the SM2 decryption logic of sm-crypto prior to version 0.3.14. By interacting with the SM2 decryption interface multiple times, an attacker can fully recover the private key within approximately several hundred interactions. Version 0.3.14 patches the issue.

Affected products

• Juneandgreen Sm-Crypto: before 0.3.14 (fixed in 0.3.14)

Published 2026-01-22. Last modified 2026-06-17.