hpke-js reuses AEAD nonces

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

hpke-js is a Hybrid Public Key Encryption (HPKE) module built on top of Web Cryptography API. Prior to version 1.7.5, the public SenderContext Seal() API has a race condition which allows for the same AEAD nonce to be re-used for multiple Seal() calls. This can lead to complete loss of Confidentiality and Integrity of the produced messages. This issue has been patched in version 1.7.5.

Source published

21 Nov 2025 18:47:19 UTC

Source modified

21 Nov 2025 19:01:11 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

hpke-js is a Hybrid Public Key Encryption (HPKE) module built on top of Web Cryptography API. Prior to version 1.7.5, the public SenderContext Seal() API has a race condition which allows for the same AEAD nonce to be re-used for multiple Seal() calls. This can lead to complete loss of Confidentiality and Integrity of the produced messages. This issue has been patched in version 1.7.5.

Source published

Nov 21, 2025, 6:47:19 PM (timezone not stated)

Source modified

Nov 21, 2025, 7:01:11 PM (timezone not stated)

Observed here

9 Nov 2026 04:07:52 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

hpke-js is a Hybrid Public Key Encryption (HPKE) module built on top of Web Cryptography API. Prior to version 1.7.5, the public SenderContext Seal() API has a race condition which allows for the same AEAD nonce to be re-used for multiple Seal() calls. This can lead to complete loss of Confidentiality and Integrity of the produced messages. This issue has been patched in version 1.7.5.

Source published

21 Nov 2025 19:16:03 UTC

Source modified

18 Oct 2026 20:10:00 UTC

Observed here

25 Oct 2026 03:17:36 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

### Summary The public SenderContext Seal() API has a race condition which allows for the same AEAD nonce to be re-used for multiple Seal() calls. This can lead to complete loss of Confidentiality and Integrity of the produced messages. ### Details The SenderContext Seal() [implementation](https://github.com/dajiaji/hpke-js/blob/b7fd3592c7c08660c98289d67c6bb7f891af75c4/packages/core/src/senderContext.ts#L22-L34) allows for concurrent executions to trigger `computeNonce()` with the same sequence number. This results in the same nonce being used in the suite's AEAD. ### PoC This code reproduces the issue (and also checks for more things that could be wrong with the implementation). ```js import { CipherSuite, KdfId, AeadId, KemId } from "hpke-js"; const suite = new CipherSuite({ kem: KemId.DhkemP256HkdfSha256, kdf: KdfId.HkdfSha256, aead: AeadId.Aes128Gcm, }); const keypair = await suite.kem.generateKeyPair(); const skR = keypair.privateKey; const pkR = keypair.publicKey; const sender = await suite.createSenderContext({ recipientPublicKey: pkR, }); const [message0, message1] = await Promise.all([ sender.seal( new TextEncoder().encode("Secret message 1: Attack at dawn").buffer ), sender.seal( new TextEncoder().encode("Secret message 2: Withdraw troops").buffer ), ]); const recipient = await suite.createRecipientContext({ recipientKey: skR, enc: sender.enc, }); const plaintext0 = await recipient.open(message0); console.log("✓ Decrypted message seq=0", new TextDecoder().decode(plaintext0)); try { console.log( "✓ Decrypted message seq=1", new TextDecoder().decode(await recipient.open(message1)) ); console.log("\n✓ nonce-reuse reproduction completed, code is NOT vulnerable"); } catch (error) { // re-sequence the recipient to verify same nonce was used for two messages recipient._ctx.seq = 0; console.log( "❌ Decrypted a different message with seq=0", new TextDecoder().decode(await recipient.open(message1)) ); console.log( "\n✓ nonce-reuse reproduction completed, code is vulnerable, nonces are reused when concurrent calls to .seal() are used" ); } // Test that failed Open() doesn't increment sequence const recipient2 = await suite.createRecipientContext({ recipientKey: skR, enc: sender.enc, }); const invalidMessage = new Uint8Array(message0.byteLength); invalidMessage.set(new Uint8Array(message0)); invalidMessage[0] ^= 0xff; // Corrupt the first byte try { await recipient2.open(invalidMessage.buffer); } catch {} // Now try to open the first valid message - should still work with seq=0 try { await recipient2.open(message0); console.log("✓ Successfully decrypted message with seq=0 after failed open()"); console.log("✓ Failed open() did NOT increment sequence"); } catch (error) { console.log("❌ Failed to decrypt message - sequence was incorrectly incremented"); } // Test that same message produces same ciphertext due to nonce reuse const sender2 = await suite.createSenderContext({ recipientPublicKey: pkR, }); const sameMessage = new TextEncoder().encode("Identical message").buffer; const [cipher0, cipher1] = await Promise.all([ sender2.seal(sameMessage), sender2.seal(sameMessage), ]); const cipher0Array = new Uint8Array(cipher0); const cipher1Array = new Uint8Array(cipher1); let identical = true; if (cipher0Array.length !== cipher1Array.length) { identical = false; } else { for (let i = 0; i < cipher0Array.length; i++) { if (cipher0Array[i] !== cipher1Array[i]) { identical = false; break; } } } if (identical) { console.log("\n❌ Same message produced IDENTICAL ciphertext (nonce reuse confirmed)"); } else { console.log("\n✓ Same message produced different ciphertext (nonces are unique)"); } ``` ### Recommendation Implement a synchronization mechanism such that only one seal()/open() per context can be executed at a time. ### Notes Refs: https://github.com/hpkewg/hpke/issues/38 > https://www.rfc-editor.org/rfc/rfc9180.html#section-9.7.5 > The AEADs specified in this document are not secure in case of nonce reuse. > https://www.rfc-editor.org/rfc/rfc9180.html#section-5-6 > A context is an implementation-specific structure that encodes the AEAD algorithm and key in use, and manages the nonces used so that the same nonce is not used with multiple plaintexts. The context implementation in @hpke/core is not correct given its AEAD Seal() is awaited/asynchronous.

Source published

20 Nov 2025 17:36:13 UTC

Source modified

21 Nov 2025 22:18:25 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Publisher rating · CRITICAL