Critical, CVSS 9.1npmAmendedPublished
@hpke/core reuses AEAD nonces
CVE-2025-64767 · GHSA-73g8-5h73-26h4
- Affected
- npm @hpke/core <= 1.7.4
- Fixed in
- 1.7.5· Vendor fix available
- Issue
- The public SenderContext Seal() API has a race condition which allows for the same AEAD nonce to be re-used for multiple Seal() calls. This can lead to complete loss of Confidentiality and Integrity of the produced messages. Details The SenderContext Seal() implementation allows for concurrent executions to trigger computeNonce() with the same sequence number. This results in the same nonce being used in the suite's AEAD. PoC This code reproduces the issue (and also checks for more things that could be wrong with the implementation). Recommendation Implement a synchronization mechanism such that only one seal()/open() per context can be executed at a time. Notes Refs: https://github.com/hpkewg/hpke/issues/38 https://www.rfc-editor.org/rfc/rfc9180.html#section-9.7.5 The AEADs specified in this document are not secure in case of nonce reuse. https://www.rfc-editor.org/rfc/rfc9180.html#section-5-6 A context is an implementation-specific structure that encodes the AEAD algorithm…
Recommended action: Upgrade to 1.7.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.