CVE-2025-46653
LOWDescription
Formidable (aka node-formidable) 2.1.0 through 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable content; however, hexoid is documented as not "cryptographically secure." (Also, there is a scenario in which only the last two characters of a hexoid string need to be guessed, but this is not often relevant.) NOTE: this does not imply that, in a typical use case, attackers will be able to exploit any hexoid behavior to upload and execute their own content.
Is your site exposed to CVE-2025-46653?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| node-formidable | formidable |
References
Advisories & Patches
Exploits
Frequently Asked Questions
What is CVE-2025-46653? +
How severe is CVE-2025-46653? +
What products are affected by CVE-2025-46653? +
How do I check if I'm vulnerable to CVE-2025-46653? +
Related Vulnerabilities
ExtremeXOS (EXOS) uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using …
The download link for files uploaded through a form relied on a token that could be predicted. The file name …
Vision UI is a collection of enterprise-grade, dependency-free modules for modern web projects. In versions 1.4.0 and below, the getSecureRandomInt …
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform …
Use of a weak pseudo-random number generator, which may allow an attacker to read or inject encrypted PowerG packets.
Guzzle OAuth Subscriber signs Guzzle requests using OAuth 1.0. Prior to 0.8.1, Nonce generation does not use sufficient entropy nor …