Vulnerability in Juneandgreen Sm-Crypto
CVE-2026-23965
sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A signature forgery vulnerability exists in the SM2 signature verification logic of sm-crypto prior to version 0.4.0. Under default configurations, an attacker can forge valid signatures for arbitrary public keys. If the message space contains sufficient redundancy, the attacker can fix the prefix of the message associated with the forged signature to satisfy specific formatting requirements. Version 0.4.0 patches the issue.
EPSS: 0.002 (9.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
Affected products
- Juneandgreen Sm-crypto — versions < 0.4.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-23965?
- CVE-2026-23965 is a high-severity vulnerability in Juneandgreen Sm-Crypto, classified under Improper Verification of Cryptographic Signature. CVSS score: 7.5/10. Published 2026-01-22.
- How severe is CVE-2026-23965?
- High severity. CVSS v3 base score is 7.5 out of 10.