CVE-2023-43646: Chaijs Get-func-name ReDoS DOS Vulnerability

CVE-2023-43646 Overview

CVE-2023-43646 is a Regular Expression Denial of Service (ReDoS) vulnerability affecting get-func-name, a module used to retrieve a function's name securely and consistently both in NodeJS and the browser. Versions prior to 2.0.1 are susceptible to this vulnerability, which can lead to denial of service when parsing malicious input containing unbalanced parentheses.

Critical Impact

This vulnerability can cause excessive CPU load and significantly increased processing time when crafted malicious input triggers catastrophic backtracking in the regular expression parser, potentially rendering applications unresponsive.

Affected Products

• chaijs get-func-name versions prior to 2.0.1
• Applications using get-func-name for Node.js environments
• Browser-based applications utilizing the vulnerable module

Discovery Timeline

• 2023-09-27 - CVE CVE-2023-43646 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-43646

Vulnerability Analysis

The vulnerability exists in the regular expression pattern used by get-func-name to parse function names. When processing input with an imbalance in parentheses, the regex engine experiences catastrophic backtracking. This algorithmic complexity attack exploits the non-linear time complexity of certain regex patterns when matched against adversarial input strings.

The ReDoS condition can be triggered using a specific payload: '\t'.repeat(54773) + '\t/function/i'. When this input is processed, the regex engine attempts numerous backtracking paths, causing CPU exhaustion and potential denial of service conditions.

Root Cause

The root cause lies in the functionNameMatch regular expression pattern used to extract function names from function source code. The original implementation did not limit the input length processed by the regex, allowing attackers to craft inputs that trigger worst-case exponential backtracking behavior. This is classified under CWE-400 (Uncontrolled Resource Consumption).

Attack Vector

The attack can be initiated remotely over the network without authentication or user interaction. An attacker can submit specially crafted input containing a large number of tab characters followed by a specific pattern to trigger the ReDoS condition. Since get-func-name is commonly used in testing frameworks and assertion libraries (particularly the Chai.js ecosystem), applications that process user-controlled function references or debugging information may be vulnerable.

const { toString } = Function.prototype;
const functionNameMatch = /\s*function(?:\s|\s*\/\*[^(?:*/)]+\*\/\s*)*([^\s(/]+)/;
+const maxFunctionSourceLength = 512;
function getFuncName(aFunc) {
  if (typeof aFunc !== 'function') {
    return null;

Source: GitHub Commit Update

The patch introduces a maxFunctionSourceLength constant of 512 characters to limit the input size processed by the regular expression, effectively preventing the catastrophic backtracking scenario.

Detection Methods for CVE-2023-43646

Indicators of Compromise

• Abnormally high CPU utilization on servers running Node.js applications
• Application threads becoming unresponsive during function name parsing operations
• Request timeout errors or slow response times correlating with specific input patterns
• Event loop lag indicators showing extended processing times

Detection Strategies

• Monitor Node.js process CPU usage for sustained spikes during request processing
• Implement application performance monitoring (APM) to detect regex execution anomalies
• Use software composition analysis (SCA) tools to identify vulnerable get-func-name versions in dependencies
• Review package-lock.json or yarn.lock for get-func-name versions below 2.0.1

Monitoring Recommendations

• Set up alerts for CPU utilization exceeding baseline thresholds on application servers
• Monitor application response times and set thresholds for anomaly detection
• Implement request timeout policies to mitigate impact of ReDoS attacks
• Use runtime application self-protection (RASP) solutions to detect regex abuse patterns

How to Mitigate CVE-2023-43646

Immediate Actions Required

• Upgrade get-func-name to version 2.0.1 or later immediately
• Audit all projects for direct or transitive dependencies on vulnerable versions
• Review applications that process untrusted input through function name parsing logic
• Implement request timeouts as a defense-in-depth measure

Patch Information

The vulnerability has been addressed in commit f934b228b5e2cb94d6c8576d3aac05493f667c69 and is included in get-func-name version 2.0.1 and later releases. The fix introduces a maximum function source length limit of 512 characters, preventing the regex from processing excessively large inputs that could trigger catastrophic backtracking.

For detailed patch information, see the GitHub Security Advisory GHSA-4q6p-r6v2-jvc5.

Workarounds

• There are no known workarounds for this vulnerability; upgrading is the only remediation
• As a temporary mitigation, implement input validation to limit the size of data processed
• Consider using request timeouts to limit the impact of potential DoS conditions
• Monitor and rate-limit requests to affected endpoints

# Upgrade get-func-name to patched version
npm update get-func-name@2.0.1

# Verify installed version
npm list get-func-name

# For yarn users
yarn upgrade get-func-name@2.0.1