Advisories for Npm/@Hpke/Core package

2025

@hpke/core reuses AEAD nonces

The public SenderContext Seal() API has a race condition which allows for the same AEAD nonce to be re-used for multiple Seal() calls. This can lead to complete loss of Confidentiality and Integrity of the produced messages.