ReDoS in Chai’s get-func-name: CVE-2023-43646 Technical Analysis & PoC

Introduction

One line of code can bring down a Node.js server or a browser-based app if it relies on the wrong regex. That is the situation for the many projects using Chai's get-func-name module, which was hit by a high-severity Regular Expression Denial of Service (ReDoS) vulnerability, CVE-2023-43646. Chai.js and its utilities like get-func-name sit under a large share of JavaScript testing and assertion logic. When a core module like this is vulnerable, the effects reach CI pipelines, production APIs, and browser-side logic.

Technical Information

CVE-2023-43646 comes from an inefficient regular expression in get-func-name (all versions prior to 2.0.1). The module extracts function names from source code strings in both Node.js and browser environments. The vulnerable regex is:

const functionNameMatch = /\s*function(?:\s|\s*\/\*[^(?:*/)]+\*\/\s*)*([^\s(/]+)/;

This pattern is open to catastrophic backtracking, especially with inputs that contain imbalanced parentheses or long, repetitive sequences. Faced with such input, the regex engine can enter a state where it tries exponentially many ways to match the pattern, which drives up CPU usage and ends in denial of service.

The root cause is the nested quantifiers and the lack of an input length check. If an attacker can supply input to any code path that calls get-func-name, they can trigger the ReDoS condition remotely. That is especially dangerous in web servers, API gateways, or browser-based tools that parse user-supplied code or function descriptors.

Proof of Concept

The following proof-of-concept shows how the vulnerability can be exploited:

const protocolre = /\sfunction(?:\s|\s*\/\*[^(?:*\/)]+\*\/\s*)*([^\(\/]+)/;

const startTime = Date.now();
const maliciousInput = '\t'.repeat(54773) + '\t/function/i';

protocolre.test(maliciousInput);

const endTime = Date.now();

console.log("Process time:", endTime - startTime, "ms");

The crafted input makes the regex engine backtrack extensively, which causes large processing delays and high CPU usage. This can DoS any service that relies on the vulnerable function. (GHSA-4q6p-r6v2-jvc5)

Patch Information

To fix CVE-2023-43646, the maintainers of get-func-name made two changes:

1. Limiting function source length: The patch caps the length of function source code that the regex will process, which prevents excessive backtracking on very large inputs.
2. Regex optimization: The regular expression was refined to reduce complexity and lower the ReDoS risk.

These changes are included in commit f934b228b, and are available in version 2.0.1 and later. Upgrade as soon as you can. (GHSA-4q6p-r6v2-jvc5)

Detection Methods

You can detect this vulnerability in several ways (GHSA-4q6p-r6v2-jvc5):

• Static code analysis: Scan your codebase for the vulnerable regex pattern:

  const functionNameMatch = /\s*function(?:\s|\s*\/\*[^(?:*\/)]+\*\/\s*)*([^\s(/]+)/;

  Tools that analyze regex complexity can flag this as a potential ReDoS vector.

• Dynamic analysis and fuzz testing: Supply imbalanced or repetitive input to any code paths that use get-func-name and watch for excessive CPU usage or delays.

• Performance monitoring: Set up alerts for abnormal CPU or memory usage, which may signal a ReDoS attack in progress.

• Regex validation: Review and validate the regex patterns in your codebase for complexity and performance.

Affected Systems and Versions

• Product: get-func-name (npm package)
• Vendor: chaijs
• Affected Versions: All versions prior to 2.0.1
• Safe Version: 2.0.1 and later
• Environments: Node.js and browser applications that use get-func-name directly or as a transitive dependency (e.g., via Chai.js)

Vendor Security History

Chai.js and its associated modules are widely used in the JavaScript testing ecosystem. The vendor responds to vulnerabilities quickly, and patched this issue within a day of disclosure. The team keeps clear advisories and communicates openly. This incident is a reminder to review regex in core utilities carefully.

References

• NVD Entry for CVE-2023-43646
• GitHub Security Advisory: GHSA-4q6p-r6v2-jvc5
• Chai.js get-func-name Security Advisory
• Patch Commit f934b228b

Source: This report was created using AI

If you have suggestions for improvement or feedback, please reach out to us at [email protected]