Is CVE-2025-46653 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-46653 being exploited in the wild.

How severe is CVE-2025-46653?

Low severity, with a CVSS score of 3.1, published 26 April 2025.

Which products and versions are affected?

formidable (npm) SEMVER:introduced=3.1.1-canary.20211030,fixed=3.5.3.

Is there a fix for CVE-2025-46653?

Yes. formidable (npm): upgrade to 3.5.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-46653 attacked?

It is attacked over the network.

Am I affected by CVE-2025-46653?

Check whether you run formidable (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-46653: Formidable weak cryptographic random in filename generation

CVE-2025-46653 · Severity: low · CVSS 3.1 · Published 2025-04-26

Formidable is a popular Node.js library for handling file uploads. The library uses a non-cryptographic random number generator (hexoid) to create filenames for untrusted executable content, making it theoretically possible for attackers to predict and guess generated filenames. While typical exploitation is difficult, this weakness could enable attackers to upload and execute malicious files if they can predict the naming scheme.

Vendors: npm.

Quick answers

Is CVE-2025-46653 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-46653 being exploited in the wild.
How severe is CVE-2025-46653?: Low severity, with a CVSS score of 3.1, published 26 April 2025.
Which products and versions are affected?: formidable (npm) SEMVER:introduced=3.1.1-canary.20211030,fixed=3.5.3.
Is there a fix for CVE-2025-46653?: Yes. formidable (npm): upgrade to 3.5.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-46653 attacked?: It is attacked over the network.
Am I affected by CVE-2025-46653?: Check whether you run formidable (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

formidable (npm): upgrade to 3.5.3 or later
```
npm install formidable@3.5.3
```

Technical details

Formidable versions 2.1.0–2.1.2 and 3.1.1–3.5.2 use the hexoid library to generate random filenames for uploaded files, but hexoid is not cryptographically secure (CWE-338). The vulnerability allows an attacker with network access to potentially predict filenames, particularly in edge cases where only the last two characters need to be guessed. The attack requires the ability to upload files and predict the generated filename before execution. The issue is addressed by switching from hexoid to cuid2, a more secure random number generator, in versions 2.1.3 and 3.5.3 and later.

Affected products

Formidable Formidable 2.1.0–2.1.2, 3.1.1–3.5.2

Identifiers

CVE-2025-46653
GHSA-75v8-2h7p-7m2m

Timeline

2025-04-26: disclosed
2025-04-26: patched: Fixed in versions 2.1.3 and 3.5.3

References

https://github.com/node-formidable/formidable/commit/022c2c5577dfe14d2947f10909d81b03b6070bf5

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.