The @hpke/core library has a race condition in its SenderContext Seal() API that causes reuse of AEAD nonces during concurrent Seal() calls. This nonce reuse violates AEAD security guarantees, leading to complete loss of confidentiality and integrity of encrypted messages. The issue affects versions prior to 1.7.5 and has been fixed in version 1.7.5.