CVE-2026-73567

Summary: The vulnerability affects the sm-crypto library (SM2/SM3/SM4) prior to version 0.5.0. The default Node.js key generation path for sm2.generateKeyPairHex() relied on a module-wide SecureRandom seeded from Math.random() and Date to an ARC4 stream because window.crypto.getRandomValues was u...

CVE-2026-73567 sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. Prior to 0.5.0, the default no-argument sm2.generateKeyPairHex path in Node.js uses the module-wide SecureRandom instance in src/sm2/utils.js, supplied by [email protected], which seeds an ARC4 strea...

sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock

Summary sm-crypto npm package 0.4.0, the latest release, published 2026-01-20 generates SM2 private keys and signing ephemeral scalars from a single module-wide RNG instance src/sm2/utils.js: const rng = new SecureRandom. SecureRandom is jsbn's PRNG, which seeds an ARC4 stream from...