CVE-2023-43646

get-func-name is a module to retrieve a function’s name securely and
consistently both in NodeJS and the browser. Versions prior to 2.0.1 are
subject to a regular expression denial of service (redos) vulnerability
which may lead to a denial of service when parsing malicious input. This
vulnerability can be exploited when there is an imbalance in parentheses,
which results in excessive backtracking and subsequently increases the CPU
load and processing time significantly. This vulnerability can be triggered
using the following input: ‘\t’.repeat(54773) + ‘\t/function/i’. This issue
has been addressed in commit f934b228b which has been included in
releases from 2.0.1. Users are advised to upgrade. There are no known
workarounds for this vulnerability.

Notes