hpke-js is a Hybrid Public Key Encryption (HPKE) module built on top of Web Cryptography API. Prior to version 1.7.5, the public SenderContext Seal() API has a race condition which allows for the same AEAD nonce to be re-used for multiple Seal() calls. This can lead to complete loss of Confidentiality and Integrity of the produced messages. This issue has been patched in version 1.7.5.
CWE-323 describes nonce reuse in cryptographic context as a critical security flaw. In this vulnerability, concurrent calls to the Seal() method can operate on the same AEAD nonce due to a race condition. Nonce reuse with the same key in AEAD modes (e.g., AES-GCM) completely compromises both confidentiality and integrity — an attacker can recover the stream encryption key or forge messages. The bug affects the library code layer built on the Web Cryptography API.
An attacker or unauthorized observer can cause complete disclosure of encrypted message contents and enable message forgery without detection by AEAD integrity mechanisms.
Update hpke-js to version 1.7.5 or later, where the bug has been fixed (commit 94a767c9b9f37ce48d5cd86f7017d8cacd294aaf). Apply the patch available in the project's GitHub repository.
hpke-js library in versions prior to 1.7.5 (core package, file packages/core/src/senderContext.ts)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N