hpke-js vulnerabilities

1 known vulnerability in hpke-js from Dajiaji. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  hpke-js: Reusing a Nonce, Key Pair in Encryption

  CVE-2025-64767Nov 21, 2025Dajiaji

  hpke-js is a Hybrid Public Key Encryption (HPKE) module built on top of Web Cryptography API. Prior to version 1.7.5, the public SenderContext Seal() API has a race condition which allows for the same AEAD nonce to be re-used for multiple Seal() calls. This ca