CVE-2026-23967: sm-crypto Signature Malleability Vulnerability

CVE-2026-23967 Overview

CVE-2026-23967 is a signature malleability vulnerability affecting the sm-crypto JavaScript library, which provides implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. The flaw exists in the SM2 signature verification logic prior to version 0.3.14, allowing attackers to derive new valid signatures for previously signed messages from existing signatures without knowledge of the private key.

Critical Impact

Attackers can forge valid signatures from existing ones, potentially bypassing signature-based authentication and authorization controls in applications relying on sm-crypto for SM2 cryptographic operations.

Affected Products

• sm-crypto JavaScript library versions prior to 0.3.14
• Applications using sm-crypto for SM2 signature verification
• Systems implementing Chinese cryptographic standards via sm-crypto

Discovery Timeline

• 2026-01-22 - CVE CVE-2026-23967 published to NVD
• 2026-01-22 - Last updated in NVD database

Technical Details for CVE-2026-23967

Vulnerability Analysis

This vulnerability is classified under CWE-347 (Improper Verification of Cryptographic Signature). The core issue lies in how the sm-crypto library handles SM2 signature verification, failing to properly validate signature uniqueness. In elliptic curve cryptography, a signature malleability vulnerability occurs when the verification function accepts multiple mathematically equivalent but different signature representations for the same message-key pair.

The SM2 algorithm, standardized by the Chinese government, utilizes elliptic curve cryptography. A properly implemented signature scheme should only accept a single canonical form of a signature. However, due to the mathematical properties of elliptic curves, for each valid signature (r, s), there exists another valid signature (r, n-s) where n is the order of the curve. If the verification logic doesn't enforce canonical signatures, an attacker can trivially compute an alternate valid signature.

Root Cause

The root cause is improper verification of cryptographic signatures in the SM2 signature verification logic. The library failed to implement proper canonicalization checks that would reject non-canonical signature forms. This oversight allows attackers to manipulate the s component of an existing signature to create a mathematically valid but distinct signature without possessing the private key.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker who observes a valid SM2 signature can derive an alternate valid signature for the same message. This attack is particularly dangerous in scenarios where:

1. Signature uniqueness is assumed for replay protection
2. Signatures are used as unique identifiers in transaction systems
3. Non-repudiation mechanisms rely on signature uniqueness

The exploitation process involves intercepting or obtaining a valid signature (r, s), computing the alternate signature (r, n-s) using publicly known curve parameters, and submitting the modified signature which will pass verification. For technical details on the specific implementation flaw and exploitation mechanics, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-23967

Indicators of Compromise

• Multiple distinct signatures validating for the same message and public key pair
• Transaction logs showing duplicate operations with different but valid signature values
• Replay-like attack patterns where operations are duplicated with modified signatures

Detection Strategies

• Implement signature logging and compare incoming signatures against historical records to detect malleability-based forgery attempts
• Monitor application logs for unusual patterns of repeated authenticated operations with varying signature values
• Audit dependency manifests (package.json, package-lock.json) to identify vulnerable sm-crypto versions in your codebase
• Use software composition analysis (SCA) tools to flag projects using sm-crypto versions prior to 0.3.14

Monitoring Recommendations

• Enable detailed logging for all SM2 signature verification operations in production environments
• Set up alerts for signature verification failures that may indicate active exploitation attempts
• Monitor npm audit reports and GitHub Dependabot alerts for vulnerable cryptographic dependencies
• Track cryptographic operation anomalies that could indicate signature manipulation attacks

How to Mitigate CVE-2026-23967

Immediate Actions Required

• Upgrade sm-crypto to version 0.3.14 or later immediately to patch the signature malleability vulnerability
• Audit applications using sm-crypto to identify all instances where SM2 signature verification is performed
• Review transaction logs and signature records for evidence of past exploitation
• Consider implementing additional application-level signature uniqueness checks as defense in depth

Patch Information

The vulnerability has been patched in sm-crypto version 0.3.14. The fix implements proper canonical signature verification that rejects malleable signature variants. Organizations should update their dependencies by running npm update sm-crypto or specifying version >=0.3.14 in their package.json. For detailed patch information and release notes, consult the GitHub Security Advisory.

Workarounds

• If immediate upgrade is not possible, implement application-layer signature normalization before storing or comparing signatures
• Add signature caching with deduplication logic to reject operations using equivalent malleable signatures
• Consider temporarily switching to alternative SM2 implementations that properly handle signature canonicalization
• Implement transaction idempotency keys that don't rely solely on signature uniqueness

# Update sm-crypto to patched version
npm update sm-crypto

# Verify installed version is 0.3.14 or later
npm list sm-crypto

# Audit for additional vulnerabilities
npm audit