CVE-2026-23967: 
JavaScript vulnerability analysis and mitigation

CVE-2026-23967 is a signature malleability vulnerability in the SM2-DSA signature verification logic of the sm-crypto JavaScript library, which implements Chinese national cryptographic standards SM2, SM3, and SM4. An attacker who possesses a valid signature for a message can mathematically derive an alternative valid signature for the same message without knowledge of the private key. All versions of sm-crypto prior to 0.3.14 (npm package) are affected. The vulnerability was published on January 20, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, Security Advisory).

The root cause is classified as CWE-347 (Improper Verification of Cryptographic Signature). In SM2-DSA, a signature consists of a pair of integers (r, s). Due to the mathematical properties of elliptic curve DSA, if (r, s) is a valid signature, then (r, n-s) — where n is the curve order — is also a valid signature for the same message. The sm-crypto library's doVerifySignature function failed to enforce canonical (low-S) form, meaning it accepted both s and n-s as valid, allowing an attacker to forge an alternative valid signature from any observed signature. This vulnerability was discovered by the XlabAI Team of Tencent Xuanwu Lab using the Atuin Automated Vulnerability Discovery Engine (Security Advisory, Github Advisory).

Successful exploitation undermines the integrity guarantees provided by SM2 digital signatures. An attacker who observes a legitimate signature can produce a second, distinct but equally valid signature for the same message, potentially bypassing signature uniqueness checks, replay-protection mechanisms, or audit log integrity controls that rely on signature identity. This is particularly impactful in applications using SM2 for authentication tokens, transaction signing, or document integrity verification, where accepting a malleable signature could allow unauthorized actions or transaction replay. Confidentiality and availability are not directly affected (Github Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported. The EPSS score is approximately 0.011% (1st percentile), indicating a very low near-term probability of exploitation (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an attacker to first obtain a valid signature produced by the target system, making opportunistic mass exploitation unlikely; however, targeted attacks against systems using SM2 for high-value transaction signing remain a concern.

1. Obtain a valid signature: Intercept or observe a legitimate SM2 signature (r, s) produced by a target application using the vulnerable sm-crypto library (e.g., via network traffic capture or API response inspection).
2. Compute the malleable signature: Using the SM2 curve order n, compute the alternative signature component s' = n - s. The new signature (r, s') is mathematically valid for the same message and public key.
3. Submit the forged signature: Present the derived signature (r, s') to the target application's signature verification endpoint. The vulnerable doVerifySignature function will accept it as valid.
4. Achieve objective: Depending on the application, this may allow replay of a previously authorized transaction with a different signature value, bypass of signature-deduplication or anti-replay controls, or impersonation in contexts where signature uniqueness is assumed (Security Advisory).

• Logs: Application logs showing the same message content accepted with two distinct signature values (differing only in the s component); repeated signature verification successes for the same logical transaction with different raw signature bytes.
• Network: Duplicate API requests carrying identical message payloads but different SM2 signature fields, particularly where s values sum to the SM2 curve order n (0xFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFF7203DF6B21C6052B53BBF40939D54123).
• Application Behavior: Anti-replay or idempotency controls being bypassed for operations that should only be accepted once, especially in financial or authentication workflows using SM2 signatures.

Upgrade the sm-crypto npm package to version 0.3.14 or later, which patches the signature malleability issue by enforcing canonical signature form during verification. No configuration-based workaround is available for the vulnerable versions; upgrading is the only effective remediation. Organizations should audit any application that uses sm-crypto for SM2 signature verification — particularly those implementing anti-replay, transaction signing, or authentication — and prioritize patching in those contexts (Github Advisory, Security Advisory).

The vulnerability was credited to the XlabAI Team of Tencent Xuanwu Lab, who used their Atuin Automated Vulnerability Discovery Engine to identify the flaw, highlighting the growing role of automated tooling in cryptographic library auditing. The advisory was noted by TheHackerWire and picked up by several vulnerability aggregators shortly after publication. No major public controversy or widespread community debate has been observed, consistent with the low EPSS score and absence of active exploitation (Security Advisory).