Every CVE Search/ Get API key

CVE-2023-43646

Inefficient Regular Expression Complexity in get-func-name

8.6 HighPublic exploitFix available

get-func-name is a module to retrieve a function's name securely and consistently both in NodeJS and the browser. Versions prior to 2.0.1 are subject to a regular expression denial of service (redos) vulnerability which may lead to a denial of service when parsing malicious input. This vulnerability can be exploited when there is an imbalance in parentheses, which results in excessive backtracking and subsequently increases the CPU load and processing time significantly. This vulnerability can be triggered using the following input: '\t'.repeat(54773) + '\t/function/i'. This issue has been addressed in commit f934b228b which has been included in releases from 2.0.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.38%Up 1.3 points since Sep 27, 2023
90%50%10%1%

What each source reports

CVE List Score used 8.6

Inefficient Regular Expression Complexity in get-func-name

get-func-name is a module to retrieve a function's name securely and consistently both in NodeJS and the browser. Versions prior to 2.0.1 are subject to a regular expression denial of service (redos) vulnerability which may lead to a denial of service when parsing malicious input. This vulnerability can be exploited when there is an imbalance in parentheses, which results in excessive backtracking and subsequently increases the CPU load and processing time significantly. This vulnerability can be triggered using the following input: '\t'.repeat(54773) + '\t/function/i'. This issue has been addressed in commit f934b228b which has been included in releases from 2.0.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
CVE-2023-43646
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Weakness
CWE-400, CWE-1333
Updated
2026-11-02
EUVDEUVD-2023-2419 8.6

get-func-name is a module to retrieve a function's name securely and consistently both in NodeJS and the browser. Versions prior to 2.0.1 are subject to a regular expression denial of service (redos) vulnerability which may lead to a denial of service when parsing malicious input. This vulnerability can be exploited when there is an imbalance in parentheses, which results in excessive backtracking and subsequently increases the CPU load and processing time significantly. This vulnerability can be triggered using the following input: '\t'.repeat(54773) + '\t/function/i'. This issue has been addressed in commit f934b228b which has been included in releases from 2.0.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
EUVD-2023-2419
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-4q6p-r6v2-jvc5 7.5

Chaijs/get-func-name vulnerable to ReDoS

The current regex implementation for parsing values in the module is susceptible to excessive backtracking, leading to potential DoS attacks. The regex implementation in question is as follows:

const functionNameMatch = /\s*function(?:\s|\s*\/\*[^(?:*/)]+\*\/\s*)*([^\s(/]+)/;

This vulnerability can be exploited when there is an imbalance in parentheses, which results in excessive backtracking and subsequently increases the CPU load and processing time significantly. This vulnerability can be triggered using the following input:

'\t'.repeat(54773) + '\t/function/i'

Here is a simple PoC code to demonstrate the issue:

const protocolre = /\sfunction(?:\s|\s/*[^(?:*\/)]+*/\s*)*([^\(\/]+)/;

const startTime = Date.now();
const maliciousInput = '\t'.repeat(54773) + '\t/function/i'

protocolre.test(maliciousInput);

const endTime = Date.now();

console.log("process time: ", endTime - startTime, "ms");
Record
GHSA-4q6p-r6v2-jvc5
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-1333
Updated
2026-11-02
NVD 8.6

get-func-name is a module to retrieve a function's name securely and consistently both in NodeJS and the browser. Versions prior to 2.0.1 are subject to a regular expression denial of service (redos) vulnerability which may lead to a denial of service when parsing malicious input. This vulnerability can be exploited when there is an imbalance in parentheses, which results in excessive backtracking and subsequently increases the CPU load and processing time significantly. This vulnerability can be triggered using the following input: '\t'.repeat(54773) + '\t/function/i'. This issue has been addressed in commit f934b228b which has been included in releases from 2.0.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
CVE-2023-43646
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-1333
Updated
2026-11-02
OSV 8.6

Inefficient Regular Expression Complexity in get-func-name

get-func-name is a module to retrieve a function's name securely and consistently both in NodeJS and the browser. Versions prior to 2.0.1 are subject to a regular expression denial of service (redos) vulnerability which may lead to a denial of service when parsing malicious input. This vulnerability can be exploited when there is an imbalance in parentheses, which results in excessive backtracking and subsequently increases the CPU load and processing time significantly. This vulnerability can be triggered using the following input: '\t'.repeat(54773) + '\t/function/i'. This issue has been addressed in commit f934b228b which has been included in releases from 2.0.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
CVE-2023-43646
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Weakness
CWE-1333, CWE-400
Updated
2026-11-02
OSVDEBIAN-CVE-2023-43646 7.5

get-func-name is a module to retrieve a function's name securely and consistently both in NodeJS and the browser. Versions prior to 2.0.1 are subject to a regular expression denial of service (redos) vulnerability which may lead to a denial of service when parsing malicious input. This vulnerability can be exploited when there is an imbalance in parentheses, which results in excessive backtracking and subsequently increases the CPU load and processing time significantly. This vulnerability can be triggered using the following input: '\t'.repeat(54773) + '\t/function/i'. This issue has been addressed in commit f934b228b which has been included in releases from 2.0.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
DEBIAN-CVE-2023-43646
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVGHSA-4q6p-r6v2-jvc5 7.5

Chaijs/get-func-name vulnerable to ReDoS

The current regex implementation for parsing values in the module is susceptible to excessive backtracking, leading to potential DoS attacks. The regex implementation in question is as follows:

const functionNameMatch = /\s*function(?:\s|\s*\/\*[^(?:*/)]+\*\/\s*)*([^\s(/]+)/;

This vulnerability can be exploited when there is an imbalance in parentheses, which results in excessive backtracking and subsequently increases the CPU load and processing time significantly. This vulnerability can be triggered using the following input:

'\t'.repeat(54773) + '\t/function/i'

Here is a simple PoC code to demonstrate the issue:

const protocolre = /\sfunction(?:\s|\s/*[^(?:*\/)]+*/\s*)*([^\(\/]+)/;

const startTime = Date.now();
const maliciousInput = '\t'.repeat(54773) + '\t/function/i'

protocolre.test(maliciousInput);

const endTime = Date.now();

console.log("process time: ", endTime - startTime, "ms");
Record
GHSA-4q6p-r6v2-jvc5
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333, CWE-400
Updated
2026-11-02
OSVUBUNTU-CVE-2023-43646 8.6

get-func-name is a module to retrieve a function's name securely and consistently both in NodeJS and the browser. Versions prior to 2.0.1 are subject to a regular expression denial of service (redos) vulnerability which may lead to a denial of service when parsing malicious input. This vulnerability can be exploited when there is an imbalance in parentheses, which results in excessive backtracking and subsequently increases the CPU load and processing time significantly. This vulnerability can be triggered using the following input: '\t'.repeat(54773) + '\t/function/i'. This issue has been addressed in commit f934b228b which has been included in releases from 2.0.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
UBUNTU-CVE-2023-43646
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
get-func-name
npm
 before 2.0.1
2.0.1
node-get-func-name
Debian:12
 All versions, plus listed versions
2.0.0+dfsg-22.0.2-1
 None known
node-get-func-name
Debian:13
 before 2.0.2-1
2.0.2-1
node-get-func-name
Debian:14
 before 2.0.2-1
2.0.2-1
node-get-func-name
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.0.0+dfsg-1
 None known
node-get-func-name
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.0.0+dfsg-1
 None known
node-get-func-name
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.0.0+dfsg-1.12.0.0+dfsg-2
 None known
qt6-webengine
Ubuntu:22.04:LTS
 All versions, plus listed versions
6.2.2+dfsg-6ubuntu26.2.4+dfsg-1ubuntu16.2.4+dfsg-1ubuntu26.2.4+dfsg-6ubuntu1
 None known
node-get-func-name
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.0.0+dfsg-22.0.2-1
 None known
qt6-webengine
Ubuntu:24.04:LTS
 All versions, plus listed versions
6.4.2-final+dfsg-116.4.2-final+dfsg-126.4.2-final+dfsg-12build16.4.2-final+dfsg-12ubuntu16.4.2-final+dfsg-12ubuntu76.4.2-final+dfsg-12ubuntu9
 None known
Show 6 moreShow less
Affected packages
PackageAffectedFixed
node-get-func-name
Ubuntu:25.10
 All versions, plus listed versions
2.0.2-1
 None known
qt6-webengine
Ubuntu:25.10
 All versions, plus listed versions
6.8.3+dfsg-0ubuntu16.8.3+dfsg-0ubuntu26.9.2+dfsg-2
 None known
node-get-func-name
Ubuntu:26.10
 All versions, plus listed versions
2.0.2-1
 None known
qt6-webengine
Ubuntu:26.10
 All versions, plus listed versions
6.10.2+dfsg-16.10.2+dfsg-46.10.2+dfsg-56.11.2+dfsg-3ubuntu16.11.2+dfsg-3ubuntu2
 None known
node-get-func-name
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.0.2-1
 None known
qt6-webengine
Ubuntu:26.04:LTS
 All versions, plus listed versions
6.9.2+dfsg-26.9.2+dfsg-46.9.2+dfsg-4build16.9.2+dfsg-4build26.10.2+dfsg-1
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHub200101WhoAmI/CVE-2023-436462024-08-21

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-43646 is a high vulnerability (CVSS 8.6) in Chaijs Get-func-name, published September 26, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.38%, the 72nd percentile. Fixed in get-func-name 2.0.1.

References

Show 4 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open