CVE-2025-64767 is a critical vulnerability affecting hpke-js versions prior to 1.7.5, a Hybrid Public Key Encryption module. A race condition in the public SenderContext Seal() API allows for the reuse of AEAD nonces, leading to a complete loss of confidentiality and integrity for encrypted messages. With a CVSS score of 9.1 (CRITICAL), this vulnerability is easily exploitable over the network with low attack complexity, potentially resulting in full compromise of sensitive data. While there are no known exploits or Metasploit modules currently available, the vulnerability has garnered significant community discussion, indicating awareness and potential for future exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Dajiaji | Hpke-Js | < 1.7.5CNA affected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.