CVE-2026-87732: Medium severity npm/mirage-crypto vulnerability
An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. The AES.GCM.authenticatedecryptinto and Chacha20.authenticatedecryptinto functions write the decrypted plaintext into a caller-provided buffer and only then compares the tag. On a forged tag, the functions returns false, but the destination buffer already holds the full plaintext.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to cause forged authenticated ciphertext to be processed by AES.GCM.authenticate_decrypt_into or Chacha20.authenticate_decrypt_into. No privileges or user interaction are indicated in the provided severity vector.
Who is exposed in practice?
Applications using affected mirage-crypto versions and either of the authenticate_decrypt_into APIs are exposed if they process attacker-controlled ciphertext and may use the caller-provided destination buffer despite authentication failure.
How can I tell whether my application is affected?
Check whether it uses mirage-crypto before 2.2.0 and calls AES.GCM.authenticate_decrypt_into or Chacha20.authenticate_decrypt_into. On a forged tag, affected behavior returns false after the destination buffer has already been filled with decrypted plaintext.
What can be done if upgrading is not immediately possible?
Do not consume, expose, or act on the destination buffer unless the authentication function reports success. Clear or discard the buffer when the function returns false to prevent unauthenticated plaintext from being used.