CVE-2026-23965: 
JavaScript vulnerability analysis and mitigation

CVE-2026-23965 is a signature forgery vulnerability in the SM2-DSA signature verification logic of the sm-crypto npm package (a JavaScript implementation of Chinese national cryptographic standards SM2, SM3, and SM4). Under default configurations, an attacker can forge valid SM2 signatures for arbitrary public keys without possessing the corresponding private key. All versions of sm-crypto prior to 0.4.0 are affected. The vulnerability was discovered by the XlabAI Team of Tencent Xuanwu Lab using the Atuin Automated Vulnerability Discovery Engine, disclosed on January 20, 2026, and published to the GitHub Advisory Database on January 21, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, GHSA Advisory).

The root cause is classified as CWE-347 (Improper Verification of Cryptographic Signature). In versions prior to 0.4.0, the doSignature and doVerifySignature functions defaulted the hash parameter to false (or left it undefined), meaning SM2 sign/verify operations were performed without applying the required SM3 hash pre-processing by default. This allowed an attacker to craft a forged signature that passes verification without knowledge of the private key, because the raw message bytes fed into the verification algorithm could be manipulated. If the target message space contains sufficient redundancy, the attacker can additionally fix the prefix of the forged message to satisfy specific formatting requirements, broadening the attack surface. The fix (commit 85295a8) changed the default value of the hash parameter to true in both doSignature and doVerifySignature, enforcing SM3 hashing by default (GHSA Advisory, Patch Commit).

Successful exploitation allows a remote, unauthenticated attacker to forge cryptographically valid SM2 signatures for any arbitrary public key, completely undermining the integrity guarantees of the signature scheme. Systems relying on SM2 signatures for authentication, authorization, or non-repudiation — such as document signing, API authentication, or certificate validation — are at risk of accepting fraudulent signatures as legitimate. There is no confidentiality or availability impact; the sole but critical consequence is a high-severity integrity compromise that could enable impersonation, bypass of access controls, or acceptance of tampered data (Github Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Github Advisory). The vulnerability is exploitable remotely with no authentication, no privileges, and no user interaction required, making it trivially accessible to any network-capable attacker if a vulnerable application exposes SM2 signature verification. The EPSS score is approximately 0.011% (1st percentile), indicating a currently low probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Upgrade sm-crypto to version 0.4.0 or later, which sets hash: true as the default for both doSignature and doVerifySignature, enforcing SM3 hashing during all sign/verify operations. The fix is available via the npm registry and the patch commit 85295a859d0766222d12ce2be3e6fce7b438b510 in the JuneAndGreen/sm-crypto repository. As a temporary workaround for applications that cannot immediately upgrade, explicitly pass { hash: true } to all calls to doSignature and doVerifySignature to ensure SM3 hashing is applied. Additionally, audit any SM2 signature verifications performed with vulnerable versions (< 0.4.0) to assess whether forged signatures may have been accepted (GHSA Advisory, Patch Commit).

The vulnerability was credited to the XlabAI Team of Tencent Xuanwu Lab and multiple individual researchers (A7um, tl2cents, keenanwgn), discovered via the Atuin Automated Vulnerability Discovery Engine, highlighting the growing role of automated tooling in cryptographic vulnerability research (GHSA Advisory). No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability aggregator entries.