CVE-2026-23967 - sm-crypto Affected by Signature Malleability in SM2-DSA

Back Back to CVE browser

HIGH

sm-crypto Affected by Signature Malleability in SM2-DSA

Published Jan 22, 2026

7.5

HIGH

CVSS 3.1

EPSS 0.21%

Description

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A signature malleability vulnerability exists in the SM2 signature verification logic of the sm-crypto library prior to version 0.3.14. An attacker can derive a new valid signature for a previously signed message from an existing signature. Version 0.3.14 patches the issue.

Affected products

Vendor JuneAndGreen Product SM-Crypto Default
n/a
- Version
  < 0.3.14
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

JuneAndGreen

SM-Crypto

n/a

Version	Status	Constraints
< 0.3.14	affected	-

Ecosystem	Package	Introduced	Fixed
npm	sm-crypto	0	0.3.14

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-347

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-3675
Advisory
https://github.com/JuneAndGreen/sm-crypto/security/advisories/GHSA-qv7w-v773-3xqm
x_refsource_CONFIRMVendor Advisory
https://github.com/advisories/GHSA-qv7w-v773-3xqm
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-23967

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-3675		Advisory
https://github.com/JuneAndGreen/sm-crypto/security/advisories/GHSA-qv7w-v773-3xqm		x_refsource_CONFIRMVendor Advisory
https://github.com/advisories/GHSA-qv7w-v773-3xqm		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-23967