What is the CVSS score of CVE-2025-46653?

CVE-2025-46653 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Formidable are affected by CVE-2025-46653?

CVE-2025-46653 is a low-severity vulnerability (CVSS 3.1). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation.. A patch is available.

Is there a public PoC exploit available for CVE-2025-46653?

Yes, a public proof-of-concept exploit is available for CVE-2025-46653. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-46653?

During next maintenance window: Apply vendor patches when convenient. Vendor patch is available.

Formidable CVE-2025-46653

LOW

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CWE-338)

2025-04-26 cve@mitre.org

Information Disclosure Formidable

3.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.1 LOW

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:38 vuln.today

Patch released

Mar 28, 2026 - 18:38 nvd

Patch available

PoC Detected

Oct 16, 2025 - 20:30 vuln.today

Public exploit code

CVE Published

Apr 26, 2025 - 21:15 nvd

LOW 3.1

DescriptionCVE.org

Formidable (aka node-formidable) 2.1.0 through 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable content; however, hexoid is documented as not "cryptographically secure." (Also, there is a scenario in which only the last two characters of a hexoid string need to be guessed, but this is not often relevant.) NOTE: this does not imply that, in a typical use case, attackers will be able to exploit any hexoid behavior to upload and execute their own content.

AnalysisAI

Technical ContextAI

This vulnerability is classified under CWE-338. Formidable (aka node-formidable) 2.1.0 through 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable content; however, hexoid is documented as not "cryptographically secure." (Also, there is a scenario in which only the last two characters of a hexoid string need to be guessed, but this is not often relevant.) NOTE: this does not imply that, in a typical use case, attackers will be able to exploit any hexoid behavior to upload and execute their own content. Affected products include: Node-Formidable Formidable. Version information: through 3..

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.