CVE-2025-46653

Formidable aka node-formidable 2.1.0 through 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable content; however, hexoid is documented as not "cryptographically secure." Also, there is a scenario in which only the last two characters of a hexoid string nee...

@blubox/body-parser (>=1.0.0, <=1.0.1), @breautek/storm (>=8.0.0, <=8.4.0) +72 more potentially affected by CVE-2025-46653 via formidable (>=3.2.4, <=3.5.2)

formidable NPM version =3.2.4, =1.0.0, =8.0.0, =0.0.1, =0.0.1, =0.0.1, =3.4.4, =0.1036.4000, =40.0.1, =1.2.1, =0.2.14, =16.0.1, =2.13.1, =2.15.3 and more Source cves: CVE-2025-46653 Source advisory: GHSA-75V8-2H7P-7M2M...

GHSA-75V8-2H7P-7M2M Formidable relies on hexoid to prevent guessing of filenames for untrusted executable content

Formidable aka node-formidable 2.x before 2.1.3 and 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable content; however, hexoid is documented as not "cryptographically secure." Also, there is a scenario in which only the last two characters of a hexoid...

@compas/server (>=0.0.219, <=0.17.0), @eamic/server (>=1.0.1, <=1.0.3) +23 more potentially affected by CVE-2025-46653 via formidable (>=2.1.1, <=2.1.2)

formidable NPM version =2.1.1, =0.0.219, =1.0.1, =3.0.0-alpha.21, =1.0.10, =1.8.8, =0.141.0, =0.0.219, =1.13.0, =1.0.9, =1.3.15, =0.1.0, =0.21.7, =0.1.0, =1.1.0 and more Source cves: CVE-2025-46653 Source advisory: GHSA-75V8-2H7P-7M2M...

@blubox/body-parser (>=1.0.0, <=1.0.1), @breautek/storm (>=8.0.0, <=8.4.0) +72 more potentially affected by CVE-2025-46653 via formidable (>=3.2.4, <=3.5.2)

formidable NPM version =3.2.4, =1.0.0, =8.0.0, =0.0.1, =0.0.1, =0.0.1, =3.4.4, =0.1036.4000, =40.0.1, =1.2.1, =0.2.14, =16.0.1, =2.13.1, =2.15.3 and more Source cves: CVE-2025-46653 Source advisory: OSV:GHSA-75V8-2H7P-7M2M...

@compas/server (>=0.0.219, <=0.17.0), @eamic/server (>=1.0.1, <=1.0.3) +23 more potentially affected by CVE-2025-46653 via formidable (>=2.1.1, <=2.1.2)

formidable NPM version =2.1.1, =0.0.219, =1.0.1, =3.0.0-alpha.21, =1.0.10, =1.8.8, =0.141.0, =0.0.219, =1.13.0, =1.0.9, =1.3.15, =0.1.0, =0.21.7, =0.1.0, =1.1.0 and more Source cves: CVE-2025-46653 Source advisory: OSV:GHSA-75V8-2H7P-7M2M...

Formidable relies on hexoid to prevent guessing of filenames for untrusted executable content

Formidable aka node-formidable 2.x before 2.1.3 and 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable content; however, hexoid is documented as not "cryptographically secure." Also, there is a scenario in which only the last two characters of a hexoid...

DEBIAN-CVE-2025-46653

Formidable aka node-formidable 2.1.0 through 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable content; however, hexoid is documented as not "cryptographically secure." Also, there is a scenario in which only the last two characters of a hexoid string nee...

CVE-2025-46653

Formidable aka node-formidable 2.1.0 through 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable content; however, hexoid is documented as not "cryptographically secure." Also, there is a scenario in which only the last two characters of a hexoid string nee...

UBUNTU-CVE-2025-46653

Formidable aka node-formidable 2.1.0 through 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable content; however, hexoid is documented as not "cryptographically secure." Also, there is a scenario in which only the last two characters of a hexoid string nee...

CVE-2025-46653

Formidable aka node-formidable 2.1.0 through 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable content; however, hexoid is documented as not "cryptographically secure." Also, there is a scenario in which only the last two characters of a hexoid string nee...

CVE-2025-46653

Formidable aka node-formidable 2.1.0 through 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable content; however, hexoid is documented as not "cryptographically secure." Also, there is a scenario in which only the last two characters of a hexoid string nee...

@blubox/body-parser (>=1.0.0, <=1.0.1), @breautek/storm (>=8.0.0, <=8.4.0) +72 more potentially affected by CVE-2025-46653 via formidable (>=3.2.4, <=3.5.2)

formidable NPM version =3.2.4, =1.0.0, =8.0.0, =0.0.1, =0.0.1, =0.0.1, =3.4.4, =0.1036.4000, =40.0.1, =1.2.1, =0.2.14, =16.0.1, =2.13.1, =2.15.3 and more Source cves: CVE-2025-46653 Source advisory: MEND:CVE-2025-46653...

@compas/server (>=0.0.219, <=0.17.0), @eamic/server (>=1.0.1, <=1.0.3) +23 more potentially affected by CVE-2025-46653 via formidable (>=2.1.1, <=2.1.2)

formidable NPM version =2.1.1, =0.0.219, =1.0.1, =3.0.0-alpha.21, =1.0.10, =1.8.8, =0.141.0, =0.0.219, =1.13.0, =1.0.9, =1.3.15, =0.1.0, =0.21.7, =0.1.0, =1.1.0 and more Source cves: CVE-2025-46653 Source advisory: MEND:CVE-2025-46653...

CVE-2025-46653

Formidable aka node-formidable 2.1.0 through 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable content; however, hexoid is documented as not "cryptographically secure." Also, there is a scenario in which only the last two characters of a hexoid string nee...

CVE-2025-46653

CVE-2025-46653 affects Formidable (node-formidable) 2.1.0–3.x up to 3.5.3. The issue is that it relies on hexoid to prevent filename guessing for untrusted executable content, but hexoid is not cryptographically secure, which could enable guessing of hexoid strings in some cases. The IBM security...

CVE-2025-46653

Formidable aka node-formidable 2.1.0 through 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable content; however, hexoid is documented as not "cryptographically secure." Also, there is a scenario in which only the last two characters of a hexoid string nee...

CVE-2025-46653: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Formidable aka node-formidable 2.1.0 through 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable content; however, hexoid is documented as not "cryptographically secure." Also, there is a scenario in which only the last two characters of a hexoid string nee...

Formidable security feature vulnerabilities

formidable is a Node.js module for formidable for parsing form data, especially file uploads. A security signature issue vulnerability exists in versions of formidable prior to 2.1.0 through 3.5.3, which stems from an insufficiently secure filename generated by hexoid, which could lead to the...

PT-2025-17962

Name of the Vulnerable Software and Affected Versions Formidable versions 2.1.0 through 3.x before 3.5.3 Description The issue relies on hexoid to prevent guessing of filenames for untrusted executable content. However, hexoid is documented as not cryptographically secure. There is a scenario in...