CVE-2026-73567Critical· 9.1▾ Midnightsm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. Prior to 0.5.0, the default no-argument sm2.generateKeyPairHex() path in Node.js uses the module-wide SecureRandom instance in src/s…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 18.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
0.3% → 0.4%
sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. Prior to 0.5.0, the default no-argument sm2.generateKeyPairHex() path in Node.js uses the module-wide SecureRandom instance in src/sm2/utils.js, supplied by [email protected], which seeds an ARC4 stream from Math.random() and new Date().getTime() because window.crypto.getRandomValues is unavailable even though globalThis.crypto exists. An attacker who can observe the process's Math.random() outputs and estimate the key-generation time can reconstruct the seed, recover generated SM2 private keys, and predict signing ephemeral scalars used to forge signatures. This issue is fixed in version 0.5.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
GHSA-vh45-f885-3848Critical· 9.1sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock
CVE-2025-66565Critical· 9.8Fiber Utils is a collection of common functions created for Fiber
CVE-2026-102813Medium· 6.1Administrator Password Reset Through the Verification-Code Interface in TP-Link RE305
CVE-2026-19742Low· 3.7IPv6 stable and temporary interface identifiers derived from a non-cryptographic PRNG secret key
CVE-2026-55889Medium· 5.3xdg-desktop-portal: xdg-desktop-portal: unauthorized data disclosure via predictable token generation (CVE-2026-55889)
CVE-2026-112240Medium· 6.3Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)