CVE-2026-73567: weak RNG in SM2 library let attackers recover keys

Researcher Guigui Wang found that a widely deployed SM2 library for Node.js seeded its PRNG state from Math.random(), and in V8 the randomness pool was never filled at module load, leaving a clock-only seed. Private keys, signing nonces and ephemeral encryption keys could be recovered by enumeration within a sub-second time window on an ordinary laptop.

• CVE-2026-73567 affects an SM2 library that seeded key material from Math.random()
• In Node.js the actual count of Math.random() calls at startup was zero, leaving a clock-only seed
• Signing nonces and ephemeral encryption keys were also exposed, not just static keys
• The maintainer reproduced the findings, expanded the impact statement and shipped a fix requiring caller-supplied CSPRNG