CVE-2025-64767
Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-11-21

Last updated on: 2025-11-21

Assigner: GitHub, Inc.

Description
hpke-js is a Hybrid Public Key Encryption (HPKE) module built on top of Web Cryptography API. Prior to version 1.7.5, the public SenderContext Seal() API has a race condition which allows for the same AEAD nonce to be re-used for multiple Seal() calls. This can lead to complete loss of Confidentiality and Integrity of the produced messages. This issue has been patched in version 1.7.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2025-11-21
Last Modified
2025-11-21
Generated
2026-07-06
AI Q&A
2025-11-21
EPSS Evaluated
2026-07-05
NVD
CVE-2025-64767

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hpke-js hpke_js *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-323 Nonces should be used for the present occasion and only once.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in hpke-js prior to version 1.7.5 is a race condition in the public SenderContext Seal() API that causes the same AEAD nonce to be reused for multiple Seal() calls. This nonce reuse can lead to a complete loss of confidentiality and integrity of the encrypted messages.

Impact Analysis

This vulnerability can lead to a complete loss of confidentiality and integrity of messages encrypted using the affected hpke-js module. An attacker could exploit the nonce reuse to decrypt or tamper with messages, compromising sensitive data and communications.

Mitigation Strategies

Upgrade hpke-js to version 1.7.5 or later, as this version contains the patch that fixes the race condition causing nonce reuse. Avoid using vulnerable versions prior to 1.7.5 to prevent loss of confidentiality and integrity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-64767. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart