CVE-2026-73567

Executive Summary

CVE-2026-73567 is a critical cryptographic weakness (CVSS 9.1) in the sm-crypto JavaScript library, which implements the Chinese national cryptographic standards SM2, SM3, and SM4. Prior to version 0.5.0, when the library is used in a Node.js environment, the default sm2.generateKeyPairHex() call with no arguments relies on an insecure pseudo-random number generator (PRNG) for key material. Specifically, the module-wide SecureRandom instance from jsbn@1.1.0 falls back to seeding an ARC4 stream from Math.random() and new Date().getTime() because it fails to detect the availability of globalThis.crypto. An attacker capable of observing the process's Math.random() outputs and estimating key-generation timing can reconstruct the seed, recover SM2 private keys, and predict signing ephemeral scalars — enabling complete compromise of confidentiality and integrity for systems relying on this library for encryption or digital signatures. The issue is fixed in version 0.5.0.

Technical Analysis

The vulnerability resides in the default key-generation path of the SM2 implementation within sm-crypto. The core issue is a broken randomness fallback mechanism, classified as CWE-338 (Use of Cryptographically Weak Pseudo-Random Number Generator).

Vulnerability Mechanism:

1. When the application calls sm2.generateKeyPairHex() without providing an explicit random source, the function invokes the module-wide SecureRandom instance defined in src/sm2/utils.js.
2. This SecureRandom instance is supplied by the jsbn library (version 1.1.0), a well-known BigInteger and random-number library for JavaScript.
3. jsbn's SecureRandom attempts to use the browser's window.crypto.getRandomValues for cryptographically secure entropy. However, in a Node.js environment, window is typically not defined (or window.crypto is unavailable), even though globalThis.crypto — which Node.js exposes via the Web Crypto API — is present.
4. Because the jsbn library's feature detection fails to recognize globalThis.crypto as a valid secure source, it executes its insecure fallback path. This fallback seeds an ARC4 (RC4) stream cipher using two highly predictable entropy sources:
   • Math.random() — a non-cryptographic PRNG with a known and exploitable state and limited period (typically 48-bit state on V8 engines).
   • new Date().getTime() — the timestamp of the key generation, measurable in milliseconds.

Attack Surface:

• Environment: Node.js servers using sm-crypto for TLS-like operations, document signing, authentication, or any protocol relying on SM2 asymmetric cryptography for transport security, message integrity, or identity verification.
• Library Scope: The default no-argument path in src/sm2/utils.js is the immediate vector. Any downstream application that does not explicitly pass a cryptographically secure random source to the key generation function inherits this flaw.
• Observability Requirement: The attacker must be able to observe outputs derived from the process's Math.random() state. This could be achievable if the application seeds other PRNG usages (e.g., for session IDs, nonces, or shuffled data) from the same global Math object, allowing the attacker to collect enough outputs to reconstruct the ARC4 seed via state-recovery techniques.

Technical Implications: Since SM2 key generation produces a private key d and a public key P = d*G, recovering d directly compromises all encryption performed to that key. Additionally, SM2 signatures require an ephemeral scalar k; if the attacker can predict k for a given signing operation — because the PRNG seed is recoverable — they can recover the private key from a single signature, even without direct key reconstruction. This makes the flaw exploitable not only against long-term keys but also against one-time signature use cases.

Exploitation Scenarios

The attack chain is inferred from the vulnerability class (weak PRNG / seed recovery) and the precise technical details in the NVD description. No public PoC is available; the chain is structured as follows:

1. Reconnaissance/Target Identification: The attacker identifies a Node.js application that impacts cryptography on a public-facing surface. This could include an authentication endpoint that validates SM2 signatures, an API gateway generating ephemeral SM2 key pairs for TLS handshakes, or a blockchain service (common adopter of SM2). The attacker fingerprints the use of sm-crypto via client-side JavaScript obfuscation patterns, response headers, or error messages referencing SM2 curve IDs.

2. Triggering the Flaw: The attacker must orchestrate conditions to trigger the insecure PRNG path. This requires the target application to call sm2.generateKeyPairHex() with no arguments within the Node.js runtime. The attacker induces key generation by initiating a handshake, requesting a signature, or registering a new identity — any action that prompts the server to invoke the weak key-gen path.

3. Seed Reconstruction & Key Recovery: Prior to or during the key generation, the attacker collects outputs derived from the server's Math.random() state. If the application exposes any endpoint that returns a value based on Math.random() (e.g., a randomized token, a shuffle index, or a diagnostic value), the attacker can gather 32–64 consecutive 32-bit outputs. Given the known V8 PRNG algorithm (xorshift128+) and the millisecond-precision timestamp from getTime(), the attacker brute-forces the 48-bit PRNG state offline (feasible in hours on commodity hardware). Once the state is matched, the ARC4 seed is reconstructed, and the attacker replays the key generation algorithm to derive the exact same private key the server generated.

4. Post-Exploitation Impact: With the recovered SM2 private key, the attacker achieves:

   • Decryption: Intercept and decrypt all ciphertexts addressed to the compromised key, including ongoing TLS sessions if SM2 is used for key exchange.
   • Signature Forgery: Forge valid SM2 signatures for arbitrary messages (e.g., transactions, documents, update commands), enabling identity impersonation and integrity violation — reflected in the CVSS integrity score of High (I:H).
   • Session Hijacking: If the key is tied to long-lived session credentials, the attacker silently takes over authenticated sessions without detection.

Impact Assessment

CVSS Breakdown: The vulnerability scores 9.1 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. This indicates:

• Attack Vector: Network (AV:N) — The attack requires network access; it is not limited to local access.
• Attack Complexity: Low (AC:L) — Exploitation requires no special conditions beyond observing Math.random() outputs and estimating time; no race or special user interaction.
• Privileges Required: None (PR:N) — The attacker does not need pre-existing authentication or authorization.
• User Interaction: None (UI:N) — The victim does not need to perform any action beyond the normal use of the application.
• Impact: Confidentiality (High) — Full private key recovery enables decryption of all protected communications and stored ciphertexts; Integrity (High) — Signature forgery allows fabrication of signed data and messages; Availability (None) — The vulnerability does not directly cause denial of service.

Affected Systems: All Node.js deployments using sm-crypto prior to 0.5.0 for SM2 key generation without explicit random source specification. This spans:

• Enterprise infrastructure: API gateways, microservices, and secure messaging platforms that adopt Chinese cryptographic standards for regulatory compliance.
• Blockchain & fintech: Projects using SM2 for wallet key management, transaction signing, or certificate-less authentication.
• Government/regulated sectors: Applications required to use SM-series algorithms for data sovereignty and e-government services.

Blast Radius: Since the flaw allows recovery of a server-held private key, the blast radius is limited to the specific impacted deployment (server compromise), but the sensitivity of the keys makes the business impact severe. A compromise of the private key undermines the non-repudiation of all signatures and the confidentiality of all communications within the affected tenancy. Lack of patch evidence (zero tracked patch sources) means all installations running < 0.5.0 remain exposed indefinitely.

Detection Guidance

The following detection logic targets anomalous Node.js runtime behavior, unusual PRNG usage patterns, and post-exploitation activities. Note that since the seed-recovery attack occurs entirely offline, detection of the exploit itself is challenging; focus shifts to pre-exploitation fingerprinting and post-compromise key misuse.

Sigma Rule

title: Suspicious Math.random Usage Preceding Crypto Key Generation
id: 8c8f1a2b-3d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects high-frequency calls to Math.random followed by SM2 key generation, indicating potential seed observation by an attacker.
logsource:
    product: nodejs
    service: application
detection:
    selection_random:
        EventName: 'Math.random'
        CallCount:
            - '>=50 in 1000ms'   # Adjust based on baseline
    selection_keygen:
        EventName: 'sm2.generateKeyPairHex'
    condition: selection_random followed_by selection_keygen
    timeframe: 5s
level: high
falsepositives:
    - Legitimate applications using Math.random for non-security purposes (e.g., game logic) immediately before crypto ops.
fields:
    - process.id
    - process.executable
    - api.path
tags:
    - attack.t1190
    - attack.collection
    - cve.2026-73567

YARA Rule

rule cve_2026_73567_jsbn_secure_random_fallback
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects jsbn SecureRandom fallback to Math.random and Date.getTime seeding, indicative of CVE-2026-73567."
        date = "2026-01-01"
        reference = "NVD CVE-2026-73567"
    strings:
        $s1 = "Math.random()" ascii
        $s2 = "new Date().getTime()" ascii
        $s3 = "SecureRandom" ascii
        $s4 = "jsbn" ascii
        $s5 = "getRandomValues" ascii
        $s6 = "window.crypto" ascii
    condition:
        (uint16(0) == 0x0A0D or uint16(0) == 0x0D0A) and // JS source file
        any of ($s1, $s2) and any of ($s3, $s4) and any of ($s5, $s6)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-73567 - SM-Crypto PRNG Fallback Detection via Response";
    flow:established,to_client;
    file.data; content:"SecureRandom"; content:"Math.random"; content:"getTime"; within:500;
    sid:20073567; rev:1; classtype:attempted-admin; metadata:cve CVE-2026-73567;)

Elastic Detection

sequence by process.entity_id with maxspan=5s
    [process where process.name == "node" and event.action == "math.random"]
    [process where process.name == "node" and process.args == "sm2.generateKeyPairHex"]

Note: Requires Node.js instrumentation emitting events for Math.random calls and crypto functions.

Splunk SPL Query

index=nodejs sourcetype=node_console
| where like(_raw, "%Math.random%") AND like(_raw, "%sm2.generateKeyPairHex%")
| transaction process_id maxspan=5s
| table _time, process_id, host, _raw

Wazuh OSSEC Rule

<rule id="100735" level="12">
    <if_sid>50000</if_sid> <!-- Base Node.js event rule -->
    <match>generateKeyPairHex</match>
    <regex>Math\.random</regex>
    <description>CVE-2026-73567: Potential SM2 key generation using insecure PRNG detected</description>
    <group>crypto_fail,</group>
</rule>

Mitigation & Patch Guidance

Patch confidence is 0/4 — UNPATCHED per tracked sources. The vendor fix is stated to be in version 0.5.0, but no patch evidence, official advisory, or vendor communication has been confirmed. Treat all versions < 0.5.0 as vulnerable.

Immediate Mitigations (compensating controls):

1. Disable automatic key generation: Halt all automated processes that invoke sm2.generateKeyPairHex() with no arguments. Route these operations through a manual, audited workflow until patched.
2. Enforce explicit random source: If upgrading is impossible, modify application code to pass a cryptographically secure random source directly to the key generation function, bypassing the module-wide SecureRandom instance. This requires code-level changes and should be validated by application security teams.
3. Monitor and rotate keys: Immediately rotate all private keys generated by the affected processes over the past six months, assuming potential compromise. Establish a baseline of Math.random() output exposure via application logs to assess historical seed leakage.
4. Restrict network exposure: Reduce the attack surface by removing public-facing functionality that exposes SM2 signatures or key generation behavior to unauthenticated users, thus decreasing the opportunity for seed observation.

Patch/Upgrade Steps:

1. Upgrade sm-crypto to version >= 0.5.0 immediately upon availability: npm install sm-crypto@latest.
2. Verify the upgrade via npm ls sm-crypto and confirm the installed version is 0.5.0 or higher.
3. Conduct a regression test on all existing SM2 key generation and signing test suites to ensure compatibility with the new random source logic.
4. Monitor the project's GitHub repository and npm registry for release notes confirming the fix addresses the globalThis.crypto fallback issue.

Long-Term Hardening:

1. Dependency audit: Run npm audit and snyk test as part of CI/CD to catch known vulnerable dependencies before deployment.
2. Code review policy: Require that all cryptographic functions explicitly source randomness from crypto.randomBytes() (Node.js) or globalThis.crypto.getRandomValues() rather than relying on library defaults.
3. Runtime monitoring: Deploy instrumentation to flag any library that calls Math.random() from inside a crypto module. Consider using --random-seed CLI flags or V8 startup flags to de-risk fallback paths.
4. Substitute libraries: For long-term projects, evaluate moving to actively maintained alternatives that strictly require secure randomness, or contribute a patch to jsbn to recognize globalThis.crypto.

References

1. NVD Entry: CVE-2026-73567 — Official vulnerability description and CVSS vector.
2. npm Package Page: sm-crypto on npm — Version history and release notes for 0.5.0.
3. GitHub Repository: JuneAndGreen/sm-crypto — Source code and issue tracker; may contain fix commit.
4. jsbn Library Documentation: jsbn on npm — Underlying PRNG implementation context.
5. CWE-338 Reference: CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) — Weakness class description.

Threat Actor Campaigns / Exploit-in-the-Wild: As of the report date, no known threat actor campaigns or exploit-in-the-wild evidence exists for CVE-2026-73567. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, and no public PoC or exploit code has been disclosed. However, the silent nature of the flaw (no patch or vendor communication) elevates the likelihood of targeted exploitation by advanced adversaries focusing on Chinese cryptography users, given the historical interest of APT groups in circumventing national cryptographic controls.