External risk intelligence

sm-crypto SM2 Private Key Recovery and Signature Forgery Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-73567

This is a cryptographic library used within applications. It is a build-time dependency and code-level component rather than an internet-facing service, appliance, or standalone product. While the library may be included in public-facing applications, the vulnerability exists in a function call within the internal logic of the code, not as a reachable network service.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in a widely used cryptographic library that could allow attackers to reconstruct private keys and forge digital signatures. This impacts systems relying on the affected cryptographic functions for secure communication and data integrity, potentially undermining trust in signed transactions or communications.

Weak random number generation can expose cryptographic keys.
This could allow forged signatures, impacting trust.
Confirm relevance and exposure within our systems.

Attack Path

How an attacker could exploit the issue

An attacker with the ability to observe the Node.js process's `Math.random()` outputs and estimate the time of key generation can reconstruct the seed used by the `sm2.generateKeyPairHex()` function. This allows them to recover generated SM2 private keys and predict ephemeral scalars used in signing operations, leading to forged signatures.

Attacker observes `Math.random()` output.
Attacker estimates key generation time.
Attacker recovers keys and forges signatures.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an attacker could potentially reconstruct seeds used for cryptographic key generation. This could lead to the recovery of generated private keys and prediction of signing scalars, enabling the forgery of digital signatures.

SM2 private keys and signing scalars.
Observing `Math.random()` and timing key generation.
Forged signatures could be generated.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts the sm-crypto JavaScript library used for Chinese cryptographic algorithms. Application or platform teams integrating this library are likely responsible for managing its security. The first practical step is to identify all instances of sm-crypto within your codebase and determine their business criticality, especially those used in generating cryptographic keys.

Application or Platform Teams own the fix.
Verify cryptographic key generation usage.
Update sm-crypto library to resolve.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is sm-crypto?

sm-crypto is a JavaScript library designed to implement Chinese cryptographic standards, specifically the SM2, SM3, and SM4 algorithms. Developers integrate this library into their Node.js applications to handle secure data tasks, such as generating cryptographic keys and signing digital information.

What does CWE-338 mean for CVE-2026-73567?

CWE-338 refers to the use of a cryptographically weak pseudo-random number generator. In this CVE, the library fails to use robust system-level randomness when generating SM2 keys. Because it relies on predictable inputs like the current time and standard mathematical functions, the resulting keys are not truly random and can be mathematically reconstructed by an attacker.

How can an attacker trigger this vulnerability?

An attacker needs to observe the outputs of the process's Math.random() function and estimate when the key generation occurred. If these conditions are met, they can calculate the seed used for key creation. Simply using the library does not trigger this; the flaw is specifically tied to the default behavior of the sm2.generateKeyPairHex() function in versions before 0.5.0.

Is my system at risk if I use this library?

Halo Surface Signal notes that this is a code-level dependency rather than a standalone network service. Risk depends on whether your application uses the affected function to generate keys in a way that is accessible to an attacker. Since this is an internal logic flaw, it is less about internet exposure and more about whether your internal application architecture relies on this specific, weakened key generation process.

How do I address this security issue?

The primary step is to audit your codebase to identify all locations where sm-crypto is utilized. If your application generates cryptographic keys using this library, you must prioritize updating to version 0.5.0 or later. This update ensures that the library uses secure, cryptographically sound methods for key generation instead of the vulnerable default path.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.