Log in Start free

Vulnerability · Published Apr 26, 2025 · Assigned by mitre

CVE-2025-46653

Low 3.1

In plain English

A low-severity security flaw in Formidable from node-formidable. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.1Low
Exploit odds (30 days)0.4%top 61.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Formidable (aka node-formidable) 2.1.0 through 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable content; however, hexoid is documented as not "cryptographically secure." (Also, there is a scenario in which only the last two characters of a hexoid string need to be guessed, but this is not often relevant.) NOTE: this does not imply that, in a typical use case, attackers will be able to exploit any hexoid behavior to upload and execute their own content.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12node-formidableno fix listedDEBIAN-CVE-2025-46653
Debian:13node-formidableno fix listedDEBIAN-CVE-2025-46653
Debian:14node-formidable3.5.4+~cs11.10.5-1DEBIAN-CVE-2025-46653
Ubuntu:22.04:LTSnode-formidableno fix listedUBUNTU-CVE-2025-46653
Ubuntu:24.04:LTSnode-formidableno fix listedUBUNTU-CVE-2025-46653
Ubuntu:25.10node-formidableno fix listedUBUNTU-CVE-2025-46653
Ubuntu:26.04:LTSnode-formidableno fix listedUBUNTU-CVE-2025-46653
Ubuntu:26.10node-formidableno fix listedUBUNTU-CVE-2025-46653
npmformidable2.1.3GHSA-75v8-2h7p-7m2m
npmformidable3.5.3GHSA-75v8-2h7p-7m2m

Affected products (as reported)

VendorProductVersions
node-formidable Formidable 2.1.0 – before 3.5.3

Weakness: CWE-338 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

References