CVE-2026-23967: Juneandgreen Sm-Crypto

High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days.

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A signature malleability vulnerability exists in the SM2 signature verification logic of the sm-crypto library prior to version 0.3.14. An attacker can derive a new valid signature for a previously signed message from an existing signature. Version 0.3.14 patches the issue.

Affected products

• Juneandgreen Sm-Crypto: before 0.3.14 (fixed in 0.3.14)

Published 2026-01-22. Last modified 2026-06-17.