PT-2025-47653 · Hpke-Js · Hpke-Js

CVE-2025-64767 · Published 2025-11-20 · Updated 2025-11-24

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions hpke-js versions prior to 1.7.5

Description hpke-js is a Hybrid Public Key Encryption (HPKE) module built on top of Web Cryptography API. A race condition exists in the public SenderContext Seal() API for versions prior to 1.7.5, allowing the same AEAD nonce to be reused for multiple Seal() calls. This can result in a complete loss of Confidentiality and Integrity of the produced messages.

Recommendations Versions prior to 1.7.5 should be updated to version 1.7.5 or later.

Exploit

Fix

Weakness Enumeration

CWE-323

Related Identifiers

CVE-2025-64767

GHSA-73G8-5H73-26H4

Affected Products

Hpke-Js

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64767.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-64767 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64767 · Vendor Advisory
• https://github.com/dajiaji/hpke-js/commit/94a767c9b9f37ce48d5cd86f7017d8cacd294aaf · Note
• https://github.com/dajiaji/hpke-js/security/advisories/GHSA-73g8-5h73-26h4 · Note
• https://github.com/dajiaji/hpke-js/blob/b7fd3592c7c08660c98289d67c6bb7f891af75c4/packages/core/src/senderContext.ts#L22-L34 · Note
• https://t.me/CVEtracker/37970 · Telegram Post
• https://twitter.com/offseq/status/1992043557503349040 · Twitter Post
• https://t.me/poxek/5698 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1p2foxr/resumen_diario_de_vulnerabilidades_20112025 · Reddit Post