CVE-2025-46653 Formidable relies on hexoid to prevent guessing of filenames for untrusted executable content
The library uses a non-cryptographically secure random generator for filenames, potentially allowing attackers to guess upload paths and bypass security controls.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-46653?
CVE-2025-46653 is a low-severity vulnerability in node-formidable Formidable, published on 26 Apr 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Formidable (aka node-formidable) 2.1.0 through 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable content; however, hexoid is documented as not "cryptographically secure." (Also, there is a scenario in which only the last two characters of a hexoid string need to be guessed, but this is not often relevant.) NOTE: this does not imply that, in a typical use case, attackers will be able to exploit any hexoid behavior to upload and execute their own content.
Weakness: CWE-338
Which versions are affected by CVE-2025-46653?
4 open source packages ship an affected version, including formidable. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
formidable npm | From 2.1.0 | 2.1.3 |
formidable npm | From 2.1.0 | 2.1.3 |
formidable npm | From 3.1.1-canary.20211030 | 3.5.3 |
formidable npm | From 3.1.1-canary.20211030 | 3.5.3 |
Products include Node-Formidable Formidable.
How do I fix CVE-2025-46653?
Upgrade formidable to a fixed version for your release line: 2.1.3 or 3.5.3.
Is CVE-2025-46653 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-46653 exists.
Sources
Also known as DEBIAN-CVE-2025-46653, GHSA-75v8-2h7p-7m2m, MINI-42fr-3gr3-37v5, ROOT-APP-NPM-CVE-2025-46653, UBUNTU-CVE-2025-46653.