Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) Affecting sm-crypto package, versions <0.5.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-JS-SMCRYPTO-18601952
- published10 Aug 2026
- disclosed24 Jul 2026
- creditUnknown
Introduced: 24 Jul 2026
CVE NOT AVAILABLE CWE-338 (opens in a new tab)How to fix?
Upgrade sm-crypto to version 0.5.0 or higher.
Overview
sm-crypto is a sm-crypto
Affected versions of this package are vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) through the generateKeyPairHex path in src/sm2/utils.js. An attacker can recover or predict SM2 private keys and signing nonces by causing a Node.js application to use the default key-generation or signing APIs, which draw randomness from jsbn’s SecureRandom seeded from Math.random() and wall-clock time in the Node runtime. This makes SM2 keys generated in Node.js guessable and enables signature forgery; any application that relies on the library’s default SM2 key or signature generation can expose private keys and lose message authenticity.