sm-crypto npm Package Vulnerability: Predictable SM2 Key Generation
- Severity
- HIGH
- Affected component
- sm-crypto (npm)
- Affected versions
- < 0.4.0 or < 0.3.14 or < 0.3.14 or < 0.5.0
- Patched version
- Not yet available
An early warning has been issued for the sm-crypto npm package, which reportedly uses a predictable random number generator for SM2 key generation in Node.js. This makes the generated keys vulnerable to prediction attacks.
What happened
The sm-crypto npm package, specifically versions less than 0.4.0, 0.3.14, and 0.5.0, is under investigation for using a predictable random number generator (RNG) in Node.js. This RNG, which combines Math.random and the wall clock, is insufficient for secure key generation. As a result, the SM2 private keys and signing ephemeral scalars generated by these versions may be vulnerable to prediction attacks.
This vulnerability, tracked as GHSA-VH45-F885-3848 and CVE-2026-73567, was first flagged on July 24, 2026. The severity is classified as high, and while there is no confirmed exploitation in the wild, the issue is critical due to the nature of the vulnerability. Users of the affected versions should assess their exposure and consider alternative libraries for cryptographic key generation until a fix is released.
What to do about it
- Await a patch from the sm-crypto maintainers. No official fix has been published yet.
- Monitor the primary sources for updates on the vulnerability and any released patches.
- Consider using alternative libraries for cryptographic key generation to mitigate the risk of predictable key generation.
- Review your project dependencies to identify any use of the affected sm-crypto versions.
- If you are using an affected version, plan to upgrade to a non-vulnerable version as soon as a patch is available.
How 0Day would have caught this
sm-crypto is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if your project uses the sm-crypto npm package in versions less than 0.4.0, 0.3.14, or 0.5.0.
What should I do right now?
Monitor the primary sources for updates and consider using alternative libraries for cryptographic key generation until a fix is released.
Is there a patch available?
No official patch has been published yet. Await updates from the sm-crypto maintainers.
How severe is this vulnerability?
The severity is classified as high due to the critical nature of predictable key generation in cryptographic operations.