CVE-2025-46653: Weak RNG
Formidable (aka node-formidable) 2.1.0 through 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable content; however, hexoid is documented as not "cryptographically secure." (Also, there is a scenario in which only the last two characters of a hexoid string need to be guessed, but this is not often relevant.) NOTE: this does not imply that, in a typical use case, attackers will be able to exploit any hexoid behavior to upload and execute their own content.
Other sources
Formidable (aka node-formidable) 2.x before 2.1.3 and 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable content; however, hexoid is documented as not "cryptographically secure." (Also, there is a scenario in which only the last two characters of a hexoid string need to be guessed, but this is not often relevant.) NOTE: this does not imply that, in a typical use case, attackers will be able to exploit any hexoid behavior to upload and execute their own content.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/formidableto a version that resolves this vulnerability.Fixed in 2.1.3 - Upgrade
Upgrade
npm/formidableto a version that resolves this vulnerability.Fixed in 3.5.3
Event History
Frequently Asked Questions
What is the severity of CVE-2025-46653?
CVE-2025-46653 is classified as a medium severity vulnerability due to the reliance on a non-cryptographically secure method for filename obfuscation.
How do I fix CVE-2025-46653?
To mitigate CVE-2025-46653, upgrade your Formidable library to version 3.5.3 or later.
What versions are affected by CVE-2025-46653?
CVE-2025-46653 affects Formidable versions from 2.1.0 up to, but not including, 3.5.3.
What vulnerabilities exist in CVE-2025-46653?
CVE-2025-46653 allows potential attackers to exploit filename guessability due to the insecure obfuscation method employed.
Who is responsible for addressing CVE-2025-46653?
Maintainers of the Formidable package are responsible for addressing CVE-2025-46653 by releasing secure updates.