Security Digest: November 20, 2025 - 2 Critical Vulnerabilities

Critical vulnerabilities discovered in the npm package @hpke/core and vLLM can lead to serious security breaches. Immediate actions include implementing synchronization mechanisms and updating to patched versions.

· 3 min read

Security Alert: Critical Vulnerabilities Discovered Today

Today's security digest highlights two critical vulnerabilities that require immediate attention. Developers and security teams must act swiftly to mitigate these threats and secure their systems.

Executive Summary

Critical vulnerabilities discovered in the npm package @hpke/core and vLLM can lead to serious security breaches. Immediate actions include implementing synchronization mechanisms and updating to patched versions to prevent exploitation.

Critical Vulnerabilities

  • CVE-2025-64767: Race Condition in @hpke/core
    • Impact: Attackers can exploit a race condition to reuse nonces, compromising message confidentiality and integrity.
    • Affected Systems: npm package @hpke/core
    • Immediate Action: Implement a synchronization mechanism to ensure only one seal() or open() operation per context is executed at a time.
    • Mitigation: Update your implementation to include the recommended synchronization, or apply patches if available.
  • CVE-2025-62164: Memory Corruption in vLLM
    • Impact: Memory corruption leading to denial-of-service and potential remote code execution.
    • Affected Systems: vLLM versions 0.10.2 and later, particularly the Completions API endpoint.
    • Immediate Action: Update to the latest patched version of vLLM, or manually apply fixes from the GitHub pull request.
    • Mitigation: Enable sparse tensor integrity checks using the torch.sparse.check_sparse_tensor_invariants context manager in PyTorch.

Previously Alerted

What to Do Now

  1. Check for any usage of the affected versions of @hpke/core and vLLM in your projects.
  2. Immediately apply the recommended synchronization in @hpke/core implementations.
  3. Update vLLM to the latest version or apply manual patches.
  4. Verify that all security patches are correctly applied by conducting rigorous testing.
  5. Monitor systems for unusual activity or signs of exploitation.

Related Resources

  • Stay tuned for more detailed analysis on our internal blog.
  • Refer to the official vendor advisories for more information.

Keep reading