Vulnerability Description
hpke-js is a Hybrid Public Key Encryption (HPKE) module built on top of Web Cryptography API. Prior to version 1.7.5, the public SenderContext Seal() API has a race condition which allows for the same AEAD nonce to be re-used for multiple Seal() calls. This can lead to complete loss of Confidentiality and Integrity of the produced messages. This issue has been patched in version 1.7.5.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/dajiaji/hpke-js/blob/b7fd3592c7c08660c98289d67c6bb7f891af75c4
- https://github.com/dajiaji/hpke-js/commit/94a767c9b9f37ce48d5cd86f7017d8cacd294a
- https://github.com/dajiaji/hpke-js/security/advisories/GHSA-73g8-5h73-26h4
FAQ
What is CVE-2025-64767?
CVE-2025-64767 is a vulnerability with a CVSS score of 9.1 (CRITICAL). hpke-js is a Hybrid Public Key Encryption (HPKE) module built on top of Web Cryptography API. Prior to version 1.7.5, the public SenderContext Seal() API has a race condition which allows for the same...
How severe is CVE-2025-64767?
CVE-2025-64767 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2025-64767?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.