CVE-2025-64767

CriticalCVSS 9.1/10Last modified Oct 18, 2026

Description

hpke-js is a Hybrid Public Key Encryption (HPKE) module built on top of Web Cryptography API. Prior to version 1.7.5, the public SenderContext Seal() API has a race condition which allows for the same AEAD nonce to be re-used for multiple Seal() calls. This can lead to complete loss of Confidentiality and Integrity of the produced messages. This issue has been patched in version 1.7.5.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-323

Affected software

No affected versions have been published.

Timeline

Published: Nov 21, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-647697.1The Process Optimization application suite leverages connection channels/protocols that by-default are not encrypted and could become subj CVE-2025-64774.8A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been declared as problematic. Affected by this vuln CVE-2025-647706.8The affected products allow unauthenticated access to Open Network Video Interface Forum (ONVIF) services, which may allow an attacker unaut CVE-2025-647728.4The installer of INZONE Hub 1.0.10.3 to 1.0.17.0 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Li CVE-2025-647733.7In JetBrains YouTrack before 2025.3.104432 a race condition allowed bypass of helpdesk Agent limit CVE-2025-647757.5Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apac CVE-2025-647767.1An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker co CVE-2025-647787.8NMIS/BioDose software V22.02 and previous versions contain executable binaries with plain text hard-coded passwords. These hard-coded passwo CVE-2025-64784.3A vulnerability was found in CodeAstro Expense Management System 1.0. It has been rated as problematic. Affected by this issue is some unkno CVE-2025-647815.1In GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZION prior to ver5.7.1, "External p CVE-2025-647837.8DNG SDK versions 1.7.0 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execu CVE-2025-647847.1DNG SDK versions 1.7.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could lead to memory exposure or applicat