CVE-2026-23966: 
JavaScript vulnerability analysis and mitigation

CVE-2026-23966 is a private key recovery vulnerability in the SM2 Public Key Encryption (SM2-PKE) decryption logic of the sm-crypto JavaScript library, which implements Chinese national cryptographic standards SM2, SM3, and SM4. By repeatedly interacting with the SM2 decryption interface — approximately several hundred interactions — an unauthenticated remote attacker can fully recover the private key. All versions of sm-crypto prior to 0.3.14 (npm package by JuneAndGreen) are affected. The vulnerability was published on January 20, 2026, and carries a CVSS v3.1 base score of 9.1 (Critical) (Github Advisory, GHSA Advisory).

The root cause is classified as CWE-345 (Insufficient Verification of Data Authenticity): the SM2 decryption function (doDecrypt) failed to validate the C1 elliptic curve point in the ciphertext before using it in scalar multiplication with the private key. This omission enables an invalid curve attack — a well-known class of attack against elliptic curve cryptography where a malicious C1 point lying on a small-order curve (not the intended SM2 curve) is submitted, causing the scalar multiplication result to leak information about the private key modulo a small prime. By submitting crafted ciphertexts with carefully chosen invalid C1 points across several hundred decryption queries, an attacker can reconstruct the full private key via the Chinese Remainder Theorem. The patch (commit b1c824e) adds a pre-check that validates the C1 point and the public key before proceeding with decryption, and also adds range checks on signature components r and s in the verification path (Patch Commit, GHSA Advisory).

Successful exploitation results in complete recovery of the SM2 private key, leading to high confidentiality and integrity impacts. An attacker who recovers the private key can decrypt all past and future communications protected by that key, and can forge digital signatures, impersonating the legitimate key holder. This effectively nullifies the cryptographic protections provided by the library for any application relying on SM2 encryption or signing, with no availability impact (Github Advisory, Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.006% (1st percentile), indicating a low near-term exploitation probability (Github Advisory). The vulnerability was discovered by the XlabAI Team of Tencent Xuanwu Lab using the Atuin Automated Vulnerability Discovery Engine, along with researchers A7um, tl2cents, and keenanwgn (GHSA Advisory). Despite the absence of public exploits, the attack requires only network access and no authentication, making it a high-priority remediation target.

1. Identify target: Locate an application or service that exposes an SM2 decryption oracle using the sm-crypto npm package (version < 0.3.14) — i.e., an endpoint that accepts ciphertext and returns decryption results or error responses.
2. Craft invalid C1 points: Generate a series of elliptic curve points that lie on small-order curves (not the SM2 curve sm2p256v1), each with a known small prime order. These are the malicious C1 components to embed in crafted ciphertexts.
3. Submit crafted ciphertexts: Send crafted decryption requests to the target's SM2 decryption interface, each containing a different invalid C1 point. The vulnerable doDecrypt function will perform scalar multiplication of the private key with the invalid point without validating it.
4. Observe responses: Collect the decryption outputs or error patterns. The result of each scalar multiplication leaks the private key modulo the small order of the submitted curve point.
5. Recover private key: After approximately several hundred interactions, apply the Chinese Remainder Theorem (CRT) to combine the collected residues and reconstruct the full SM2 private key (GHSA Advisory, Patch Commit).

• Network: Unusually high volume of SM2 decryption requests to an application endpoint from a single source IP or a small set of IPs within a short time window (hundreds of requests).
• Network: Repeated decryption requests containing ciphertext with C1 points that fail elliptic curve point validation (i.e., points not on the SM2 curve).
• Logs: Application logs showing a large number of decryption calls returning empty results or errors (e.g., empty string '' or empty array []) due to invalid C1 point rejection — this pattern may appear in patched systems if an attacker attempts the attack post-patch.
• Logs: Anomalous access patterns in API or web server logs: sequential or scripted requests to decryption endpoints with varying ciphertext payloads but consistent structure.
• Application Behavior: Unexpected or repeated invocations of the doDecrypt function with malformed or non-standard ciphertext inputs, observable via application-level monitoring or APM tools.

Upgrade the sm-crypto npm package to version 0.3.14 or later, which adds pre-validation of the C1 elliptic curve point and public key before performing scalar multiplication in doDecrypt, and adds range checks on signature components in doVerifySignature (Patch Commit, Github Advisory). Run npm install sm-crypto@0.3.14 or update your package.json dependency accordingly. As a temporary workaround where immediate upgrade is not possible, restrict access to SM2 decryption endpoints to trusted clients only (e.g., via network-level controls or authentication), and implement rate limiting to reduce the feasibility of the multi-query attack.

The vulnerability was discovered by the XlabAI Team of Tencent Xuanwu Lab using their Atuin Automated Vulnerability Discovery Engine, highlighting the growing role of AI-assisted vulnerability research in identifying cryptographic implementation flaws (GHSA Advisory). Coverage appeared on security news aggregators and vulnerability tracking sites including The Hacker Wire and Infinitsec shortly after disclosure (Feedly). Red Hat also tracked the vulnerability for potential impact on their products (Red Hat CVE).