Vulnerabilities

TI-2026-51657 CVE-2026-73567 · GHSA-vh45-f885-3848

sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock

MEDIUM 48

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00444 Published 2026-08-13 Fixed in 0.5.0 CWE-338

TI-2026-19308 CVE-2026-23966 · GHSA-pgx9-497m-6c4v

MEDIUM 47

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00232 Published 2026-01-22 Fixed in 0.3.14 CWE-345

TI-2026-19307 CVE-2026-23965 · GHSA-hpwg-xg7m-3p6m

LOW 38

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00215 Published 2026-01-22 Fixed in 0.4.0 CWE-347

TI-2026-19309 CVE-2026-23967 · GHSA-qv7w-v773-3xqm

LOW 38

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00211 Published 2026-01-22 Fixed in 0.3.14 CWE-347