Is CVE-2026-23966 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-23966 being exploited in the wild.

How severe is CVE-2026-23966?

Low severity, with a CVSS score of 3.1, published 21 January 2026.

Which products and versions are affected?

sm-crypto (npm) SEMVER:introduced=0,fixed=0.3.14.

Is there a fix for CVE-2026-23966?

Yes. sm-crypto (npm): upgrade to 0.3.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-23966 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-23966?

Check whether you run sm-crypto (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-23966: sm-crypto private key recovery in SM2 decryption

CVE-2026-23966 · Severity: low · CVSS 3.1 · Published 2026-01-21

sm-crypto is a JavaScript library implementing the SM2 public-key cryptosystem, commonly used in Chinese applications for data encryption and digital signatures. A vulnerability in its SM2 decryption logic allows attackers to recover the user's private key through repeated interactions with the decryption interface—approximately several hundred calls suffice to fully extract the key. This compromises the confidentiality and integrity of all data protected by the affected key.

Technologies: sm-crypto (npm). Vendors: npm.

Quick answers

Is CVE-2026-23966 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-23966 being exploited in the wild.
How severe is CVE-2026-23966?: Low severity, with a CVSS score of 3.1, published 21 January 2026.
Which products and versions are affected?: sm-crypto (npm) SEMVER:introduced=0,fixed=0.3.14.
Is there a fix for CVE-2026-23966?: Yes. sm-crypto (npm): upgrade to 0.3.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-23966 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-23966?: Check whether you run sm-crypto (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

sm-crypto (npm): upgrade to 0.3.14 or later
```
npm install sm-crypto@0.3.14
```

Technical details

The vulnerability is a private key recovery flaw in the SM2 decryption implementation (CWE-345: Insufficient Verification of Data Authenticity). An attacker can exploit the decryption interface via network access without authentication or user interaction to perform a key recovery attack. By sending multiple crafted ciphertexts to the decryption function and analyzing the responses, an attacker can gradually recover the full private key within several hundred interactions. The attack is purely algorithmic and requires no special privileges. This vulnerability was patched in version 0.3.14.

Affected products

JuneAndGreen sm-crypto <0.3.14

Identifiers

CVE-2026-23966
GHSA-pgx9-497m-6c4v

Timeline

2026-01-21: disclosed: Advisory published
2026-01-21: patched: Fixed in version 0.3.14

References

https://github.com/JuneAndGreen/sm-crypto/security/advisories/GHSA-pgx9-497m-6c4v

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.