npmPackage

sm-crypto

4 known vulnerabilities (2 critical, 2 high), with the versions each affects and the releases that fix them.

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-73567Critical 9.1
sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock
Affected: fixed in 0.5.0.
Fixed in 0.5.0 (released Jul 23, 2026, 21 days before disclosure).
The latest release, 0.5.8, is not affected.
75% of sm-crypto downloads last week were affected versions (33.2K).
CVE-2026-23966Critical 9.1
sm-crypto Affected by Private Key Recovery in SM2-PKE
Affected: fixed in 0.3.14.
Fixed in 0.3.14 (released Jan 20, 2026, 2 days before disclosure).
The latest release, 0.5.8, is not affected.
29% of sm-crypto downloads last week were affected versions (12.9K).
CVE-2026-23965High 7.5
sm-crypto Affected by Signature Forgery in SM2-DSA
Affected: fixed in 0.4.0.
Fixed in 0.4.0 (released Jan 20, 2026, 2 days before disclosure).
The latest release, 0.5.8, is not affected.
66% of sm-crypto downloads last week were affected versions (29.3K).
CVE-2026-23967High 7.5
sm-crypto Affected by Signature Malleability in SM2-DSA
Affected: fixed in 0.3.14.
Fixed in 0.3.14 (released Jan 20, 2026, 2 days before disclosure).
The latest release, 0.5.8, is not affected.
29% of sm-crypto downloads last week were affected versions (12.9K).