Skip to content
OpenAdvisories

Package · npm

sm-crypto

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-73567

    sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock

    sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. Prior to 0.5.0, the default no-argument sm2.generateKeyPairHex() path in Node.js uses the module-wide SecureRandom instance in src/sm2/utils.js, supplied …

    JuneAndGreen sm-crypto sm-crypto npm
  • Critical 9.1
    CVE-2026-23966

    sm-crypto Affected by Private Key Recovery in SM2-PKE

    sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A private key recovery vulnerability exists in the SM2 decryption logic of sm-crypto prior to version 0.3.14. By interacting with the SM2 decryption inter…

    JuneAndGreen sm-crypto sm-crypto npm