Formidable (aka node-formidable) 2.1.0 through 3.x before 3.5.3 relies on hexoid to…
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 9 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
Formidable (aka node-formidable) 2.1.0 through 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable content; however, hexoid is documented as not "cryptographically secure." (Also, there is a scenario in which only the last two characters of a hexoid string need to be guessed, but this is not often relevant.) NOTE: this does not imply that, in a typical use case, attackers will be able to exploit any hexoid behavior to upload and execute their own content.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| node-formidable | Formidable | 2.1.0 to before 3.5.3 | 3.5.3 | Patch available | CNA |
| — | formidable (npm) | 3.1.1-canary.20211030 to before 3.5.3 | 3.5.3 | Patch available | GHSA-75v8-2h7p-7m2m |
| — | formidable (npm) | 2.1.0 to before 2.1.3 | 2.1.3 | Patch available | GHSA-75v8-2h7p-7m2m |
- Formidable Vendornode-formidable Affected 2.1.0 to before 3.5.3 Fixed in 3.5.3 Patch available CNA
- formidable (npm) Vendor— Affected 3.1.1-canary.20211030 to before 3.5.3 Fixed in 3.5.3 Patch available GHSA-75v8-2h7p-7m2m
- formidable (npm) Vendor— Affected 2.1.0 to before 2.1.3 Fixed in 2.1.3 Patch available GHSA-75v8-2h7p-7m2m
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:node-formidable:formidable:*:*:*:*:*:node.js:*:* | 2.1.0 to before 3.5.3 | Vulnerable | node-formidable |
- cpe:2.3:a:node-formidable:formidable:*:*:*:*:*:node.js:*:* Versions 2.1.0 to before 3.5.3 Vulnerable ·node-formidable
Remediation
- Fix · CNA Formidable (node-formidable) Fixed in 3.5.3
- Fix · GHSA-75v8-2h7p-7m2m formidable (npm) Fixed in 3.5.3 Advisory →
- Fix · GHSA-75v8-2h7p-7m2m formidable (npm) Fixed in 2.1.3 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Serverless | Affected | No fix yet: Fix deferred |
| Red Hat Developer Hub 1 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 6 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift GitOps | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2025-46653
- 2026-10-03 Alias added: GHSA-75v8-2h7p-7m2m
- 2026-10-27 Affected versions changed · Red Hat
References
Exploit 1
Patch 1
Other 5
- https://github.com/node-formidable/formidable/blob/d0fbec13edc8add54a1afb9ce1a8d3db803f8d47/CHANGELOG.md?plain=1#L10
- https://github.com/node-formidable/formidable/commit/37a3e89fca1ed68ec674a539f13aafd62221ddaa
- https://github.com/node-formidable/formidable
- https://www.npmjs.com/package/formidable/v/2.1.3
- https://www.npmjs.com/package/formidable/v/3.5.3
Sources
- CVE-2025-46653 · CVE Program
- CVE-2025-46653 · NVD
- FIRST EPSS
- GHSA-75v8-2h7p-7m2m · GitHub Advisory Database · CC BY 4.0
- CVE-2025-46653 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences