[GHSA-75v8-2h7p-7m2m] Formidable relies on hexoid to prevent guessing of filenames for untrusted executable content

[diego-santacruz]

Updates

• Affected products
• Description

Comments
According to https://github.com/node-formidable/formidable/commits/v2-latest/ version 2.1.3 included the fix. But for some reason Depandabot is not creating any PR, I guess it may be because the advisory does not list 2.1.3 as patched version.

Note that 2.1.3 and 2.1.4 were not listed as active versions in npmjs.com. That was fixed with version 2.1.5 which is now listed at https://www.npmjs.com/package/formidable?activeTab=versions

[Copilot]

Pull Request Overview

This PR updates the advisory details for the Formidable vulnerability by refining the affected version range and adjusting metadata timestamps.

• Updated details field to change vulnerable version range from "2.1.0 through 3.x" to "2.x before 2.1.3" and "3.x before 3.5.3".
• Removed the redundant database_specific.last_known_affected_version_range field.

Comments suppressed due to low confidence (2)

advisories/github-reviewed/2025/04/GHSA-75v8-2h7p-7m2m/GHSA-75v8-2h7p-7m2m.json:54

• The removal of the 'database_specific.last_known_affected_version_range' field simplifies the structure, but please verify that this change does not break any downstream consumers that depend on this field.

"]"

advisories/github-reviewed/2025/04/GHSA-75v8-2h7p-7m2m/GHSA-75v8-2h7p-7m2m.json:10

• The updated details text now uses a refined version range (2.x before 2.1.3) which is a more precise reflection of the vulnerable versions; please confirm that this phrasing accurately matches the intended affected versions.

"details": "Formidable (aka node-formidable) 2.x before 2.1.3 and 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable content; however, hexoid is documented as not \"cryptographically secure.\" (Also, there is a scenario in which only the last two characters of a hexoid string need to be guessed, but this is not often relevant.) NOTE: this does not imply that, in a typical use case, attackers will be able to exploit any hexoid behavior to upload and execute their own content."

[advisory-database]

Hi @diego-santacruz! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!