# CVE-2025-64767: @hpke/core AEAD nonce reuse in SenderContext

Source: https://junglewise.ai/threats/cve-2025-64767-hpke-core-aead-nonce-reuse-in-sendercontext  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-21. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-64767 · Severity: critical · CVSS 9.1 · Published 2025-11-21

@hpke/core is a JavaScript cryptography library implementing the HPKE (Hybrid Public Key Encryption) standard. A race condition in the SenderContext.Seal() API allows concurrent encryption calls to reuse the same nonce, completely compromising the confidentiality and integrity of encrypted messages. An attacker can decrypt messages or forge valid ciphertexts without knowledge of the encryption key.

Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-64767 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-64767 being exploited in the wild.

**How severe is CVE-2025-64767?** Critical severity, with a CVSS score of 9.1, published 21 November 2025.

**Which products and versions are affected?** @hpke/core (npm) SEMVER:introduced=0,fixed=1.7.5.

**Is there a fix for CVE-2025-64767?** Yes. @hpke/core (npm): upgrade to 1.7.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-64767 attacked?** It is attacked over the network.

**Am I affected by CVE-2025-64767?** Check whether you run @hpke/core (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @hpke/core (npm): upgrade to 1.7.5 or later

  ```sh
  npm install @hpke/core@1.7.5
  ```


## Technical details

The vulnerability is a race condition (CWE-323) in the asynchronous SenderContext.Seal() implementation. The computeNonce() method can be invoked concurrently with identical sequence numbers, causing multiple seal() operations to generate and use the same AEAD nonce. Since AEAD schemes are cryptographically unsafe under nonce reuse, this completely breaks confidentiality and integrity guarantees. The attack requires only network access to an application using concurrent seal() calls; no authentication or user interaction is needed. The vulnerability affects all versions up to and including 1.7.4, with a fix available in version 1.7.5 or later that implements synchronization to ensure only one seal()/open() operation executes per context at a time.

## Affected products

- @hpke core <= 1.7.4

## Identifiers

- CVE-2025-64767
- GHSA-73g8-5h73-26h4

## Timeline

- 2025-11-20: disclosed
- 2025-11-20: patched: Fixed in version 1.7.5

## References

- [https://github.com/dajiaji/hpke-js/security/advisories/GHSA-73g8-5h73-26h4](https://github.com/dajiaji/hpke-js/security/advisories/GHSA-73g8-5h73-26h4)