CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
EPSS
Percentile
20.5%
get-func-name is a module to retrieve a functionโs name securely and consistently both in NodeJS and the browser. Versions prior to 2.0.1 are subject to a regular expression denial of service (redos) vulnerability which may lead to a denial of service when parsing malicious input. This vulnerability can be exploited when there is an imbalance in parentheses, which results in excessive backtracking and subsequently increases the CPU load and processing time significantly. This vulnerability can be triggered using the following input: โ\tโ.repeat(54773) + โ\t/function/iโ. This issue has been addressed in commit f934b228b
which has been included in releases from 2.0.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Vendor | Product | Version | CPE |
---|---|---|---|
chaijs | get-func-name | * | cpe:2.3:a:chaijs:get-func-name:*:*:*:*:*:node.js:*:* |
[
{
"vendor": "chaijs",
"product": "get-func-name",
"versions": [
{
"version": "< 2.0.1",
"status": "affected"
}
]
}
]