Skip to content
OpenAdvisories
High · 8.6 Public exploit CVE-2023-43646 EUVD-2023-2419GHSA-4q6p-r6v2-jvc5

Inefficient Regular Expression Complexity in get-func-name

Published Sep 26, 2023 · Updated Sep 24, 2024 · Assigned by GitHub_M

Description

get-func-name is a module to retrieve a function's name securely and consistently both in NodeJS and the browser. Versions prior to 2.0.1 are subject to a regular expression denial of service (redos) vulnerability which may lead to a denial of service when parsing malicious input. This vulnerability can be exploited when there is an imbalance in parentheses, which results in excessive backtracking and subsequently increases the CPU load and processing time significantly. This vulnerability can be triggered using the following input: '\t'.repeat(54773) + '\t/function/i'. This issue has been addressed in commit `f934b228b` which has been included in releases from 2.0.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products

VendorProductAffectedFixed
chaijs get-func-name < 2.0.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 node-get-func-name 2.0.2-1 —
Debian 13 node-get-func-name 2.0.2-1 —
Debian 12 node-get-func-name No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 qt6-webengine +1 No fix yet —
Ubuntu 26.04 LTS qt6-webengine +1 No fix yet —
Ubuntu 25.10 qt6-webengine +1 No fix yet —
Ubuntu 24.04 LTS qt6-webengine +1 No fix yet —
Ubuntu 22.04 LTS qt6-webengine +1 No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS node-get-func-name No fix yet —
Ubuntu 18.04 LTS node-get-func-name No fix yet —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
npm get-func-name < 2.0.1 2.0.1 GHSA-4q6p-r6v2-jvc5

References