RUSTSEC-2026-0071 — Nonce Reuse in hpke-rs — Advisory Details

The sequence number that is used to compute the AEAD nonce when using a re-usable HPKE context is incremented after each seal or open operation. This sequence number was stored as a `u32` and used regular addition on `u32` for the increment, meaning in release mode it would silently wrap around to 0 after 2^32 seal or open operations. ## Impact Nonce reuse causes catastrophic breakage of AEAD ciphers, enabling plaintext recovery attacks and authentication tag forgeries, depending on the concrete AEAD. This bug impacts applications that use hpke-rs to encrypt a large number of messages using the same context. Applications using the one-shot APIs are unaffected. ## Mitigation Starting with version `0.6.0`, `checked_add` is used to increment the sequence number, which avoids a silent wraparound in release mode. Additionally, the sequence number is now stored as a `u64`, increasing the maximally allowed number of seal and open operations on a given HPKE context.