Vulnerability Description
Formidable (aka node-formidable) 2.1.0 through 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable content; however, hexoid is documented as not "cryptographically secure." (Also, there is a scenario in which only the last two characters of a hexoid string need to be guessed, but this is not often relevant.) NOTE: this does not imply that, in a typical use case, attackers will be able to exploit any hexoid behavior to upload and execute their own content.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Node-Formidable | Formidable | >= 2.1.0, < 3.5.3 |
Related Weaknesses (CWE)
References
- https://github.com/node-formidable/formidable/blob/d0fbec13edc8add54a1afb9ce1a8dProduct
- https://github.com/node-formidable/formidable/commit/022c2c5577dfe14d2947f10909dPatch
- https://github.com/zast-ai/vulnerability-reports/blob/main/formidable/file_uploaExploitThird Party Advisory
- https://github.com/zast-ai/vulnerability-reports/blob/main/formidable/file_uploaExploitThird Party Advisory
FAQ
What is CVE-2025-46653?
CVE-2025-46653 is a vulnerability with a CVSS score of 3.1 (LOW). Formidable (aka node-formidable) 2.1.0 through 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable content; however, hexoid is documented as not "cryptographica...
How severe is CVE-2025-46653?
CVE-2025-46653 has been rated LOW with a CVSS base score of 3.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-46653?
Check the references section above for vendor advisories and patch information. Affected products include: Node-Formidable Formidable.