CRITICAL
JuneAndGreen
CVE published 2026-08-13
CVE-2026-73567
The sm-crypto library, which provides JavaScript implementations of Chinese cryptographic algorithms, had a critical vulnerability prior to version 0.5.0. The default key generation path in Node.js used a module-wide SecureRandom instance seeded with Math.random() and new Date().getTime(). An attacker who can observe Math.random() outputs and estimate key generation time can reconstruct the seed, recover [truncated]