Is CVE-2026-23965 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-23965 being exploited in the wild.

How severe is CVE-2026-23965?

Low severity, with a CVSS score of 3.1, published 21 January 2026.

Which products and versions are affected?

sm-crypto (npm) SEMVER:introduced=0,fixed=0.4.0.

Is there a fix for CVE-2026-23965?

Yes. sm-crypto (npm): upgrade to 0.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-23965 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-23965?

Check whether you run sm-crypto (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-23965: sm-crypto signature forgery in SM2-DSA

CVE-2026-23965 · Severity: low · CVSS 3.1 · Published 2026-01-21

sm-crypto is a JavaScript library that implements SM2, a widely-used cryptographic signature algorithm. A flaw in its signature verification logic allows attackers to forge valid signatures for arbitrary keys, potentially enabling unauthorized document signing, authentication bypass, or transaction spoofing in applications relying on SM2 signatures for integrity protection.

Technologies: sm-crypto (npm). Vendors: npm.

Quick answers

Is CVE-2026-23965 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-23965 being exploited in the wild.
How severe is CVE-2026-23965?: Low severity, with a CVSS score of 3.1, published 21 January 2026.
Which products and versions are affected?: sm-crypto (npm) SEMVER:introduced=0,fixed=0.4.0.
Is there a fix for CVE-2026-23965?: Yes. sm-crypto (npm): upgrade to 0.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-23965 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-23965?: Check whether you run sm-crypto (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

sm-crypto (npm): upgrade to 0.4.0 or later
```
npm install sm-crypto@0.4.0
```

Technical details

A signature forgery vulnerability exists in the SM2-DSA signature verification implementation due to improper cryptographic signature validation (CWE-347). Under default configurations, an attacker can craft valid signatures for arbitrary public keys without possessing the corresponding private key. The attack requires network access to the application consuming sm-crypto, with no authentication or user interaction needed. If the message format contains sufficient redundancy, an attacker can control the message prefix while maintaining signature validity, enabling targeted forgery attacks. The vulnerability affects all versions prior to 0.4.0, which contains the fix.

Affected products

JuneAndGreen sm-crypto <0.4.0

Identifiers

CVE-2026-23965
GHSA-hpwg-xg7m-3p6m

Timeline

2026-01-21: disclosed: Vulnerability published on GitHub Security Advisory
2026-01-21: patched: Fixed in version 0.4.0

References

https://github.com/JuneAndGreen/sm-crypto/security/advisories/GHSA-hpwg-xg7m-3p6m

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.