https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T00:47:42.760427+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2025-64767 CVE-2025-64767 — hpke-js reuses AEAD nonces 2026-10-08T00:47:42.776481+00:00

Affected: dajiaji hpke-js

hpke-js is a Hybrid Public Key Encryption (HPKE) module built on top of Web Cryptography API. Prior to version 1.7.5, the public SenderContext Seal() API has a race condition which allows for the same AEAD nonce to be re-used for multiple Seal() calls. This can lead to complete loss of Confidentiality and Integrity of the produced messages. This issue has been patched in version 1.7.5.