Inefficient Regular Expression Complexity in get-func-name
Description
get-func-name is a module to retrieve a function's name securely and consistently both in NodeJS and the browser. Versions prior to 2.0.1 are subject to a regular expression denial of service (redos) vulnerability which may lead to a denial of service when parsing malicious input. This vulnerability can be exploited when there is an imbalance in parentheses, which results in excessive backtracking and subsequently increases the CPU load and processing time significantly. This vulnerability can be triggered using the following input: '\t'.repeat(54773) + '\t/function/i'. This issue has been addressed in commit f934b228b which has been included in releases from 2.0.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
get-func-namenpm | < 2.0.1 | 2.0.1 |
Affected products
1- Range: < 2.0.1
Patches
1f934b228b5e2Merge pull request from GHSA-4q6p-r6v2-jvc5
3 files changed · +9027 −6174
index.js+7 −0 modified@@ -13,6 +13,7 @@ const { toString } = Function.prototype; const functionNameMatch = /\s*function(?:\s|\s*\/\*[^(?:*/)]+\*\/\s*)*([^\s(/]+)/; +const maxFunctionSourceLength = 512; function getFuncName(aFunc) { if (typeof aFunc !== 'function') { return null; @@ -22,6 +23,12 @@ function getFuncName(aFunc) { if (typeof Function.prototype.name === 'undefined' && typeof aFunc.name === 'undefined') { // Here we run a polyfill if Function does not support the `name` property and if aFunc.name is not defined // eslint-disable-next-line prefer-reflect + const functionSource = toString.call(aFunc); + // To avoid unconstrained resource consumption due to pathalogically large function names, + // we limit the available return value to be less than 512 characters. + if (functionSource.indexOf('(') > maxFunctionSourceLength) { + return name; + } const match = toString.call(aFunc).match(functionNameMatch); if (match) { [ name ] = match;
package-lock.json+9007 −6174 modifiedtest/index.js+13 −0 modified@@ -31,6 +31,19 @@ describe('getFuncName', function () { assert(getFuncName(anonymousFunc) === ''); }); + it('should return an empty string for overly large function names', function () { + // eslint-disable-next-line max-len, func-style, func-name-matching, id-length + const longFunc = function aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa() {}; + Object.defineProperty(longFunc, 'name', { value: undefined }); + // Temporarily disable the Function.prototype.name getter + const realFPName = Object.getOwnPropertyDescriptor(Function.prototype, 'name'); + // eslint-disable-next-line no-extend-native + Object.defineProperty(Function.prototype, 'name', { value: undefined }); + assert(getFuncName(longFunc) === ''); + // eslint-disable-next-line no-extend-native + Object.defineProperty(Function.prototype, 'name', realFPName); + }); + it('should return `null` when passed a String as argument', function () { assert(getFuncName('') === null); });
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5- github.com/advisories/GHSA-4q6p-r6v2-jvc5ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-43646ghsaADVISORY
- github.com/chaijs/get-func-name/blob/78ad756441a83f3dc203e50f76c113ae3ac017dc/index.jsghsaWEB
- github.com/chaijs/get-func-name/commit/f934b228b5e2cb94d6c8576d3aac05493f667c69ghsax_refsource_MISCWEB
- github.com/chaijs/get-func-name/security/advisories/GHSA-4q6p-r6v2-jvc5ghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.