Invalid Curve, Infinite Problems: Breaking SM2 in sm-crypto
Jan 22, 2026·7 min read·9 visits
Executive Summary (TL;DR)
The `sm-crypto` library (versions < 0.3.14) forgot to verify if incoming public key points actually belong to the SM2 curve. This allows attackers to send 'invalid' points that force the server to perform calculations on weak curves, leaking the private key in just a few hundred requests. If you use this for SM2 decryption, your keys are gone.
A critical cryptographic implementation flaw in the widely used `sm-crypto` library allows remote attackers to recover private keys via an Invalid Curve Attack. By failing to validate that ephemeral public keys lie on the correct elliptic curve during decryption, the library leaks private key bits through mathematical side channels.
Official Patches
Fix Analysis (1)
Technical Appendix
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NAffected Systems
Affected Versions Detail
| Product | Affected Versions | Fixed Version |
|---|---|---|
sm-crypto JuneAndGreen | < 0.3.14 | 0.3.14 |
| Attribute | Detail |
|---|---|
| CWE ID | CWE-345 |
| Attack Vector | Network |
| CVSS v3.1 | 9.1 (Critical) |
| Bug Class | Invalid Curve Attack |
| Exploit Status | Proof of Concept Available |
| Language | JavaScript |
MITRE ATT&CK Mapping
Insufficient Verification of Data Authenticity
Known Exploits & Detection
Vulnerability Timeline
Subscribe to updates
Get the latest CVE analysis reports delivered to your inbox.