Finance.js vulnerable to DoS via the IRR function’s depth parameter

Description

Finance.js v4.1.0 contains a Denial of Service (DoS) vulnerability via the IRR function’s depth parameter. Improper handling of the recursion/iteration limit can lead to excessive CPU usage, causing application stalls or crashes.

Recommendation

No fix is available yet. Followings are affected versions:

<= 4.1.0

References

GHSA-f8r4-mf27-rf7m
medium.com
raw.githack.com
financejs.com
CVE-2025-56571
CWE-400
CWE-770
CWE-834
CAPEC-310
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for Finance.js vulnerable to DoS via the IRR function’s depth parameter and gives you actionable findings to investigate.

Start a free scan

Related Issues

Finance.js vulnerable to DoS via the seekZero() parameter - CVE-2025-56572
Flowise Vulnerable to SQL Injection via `tableName` Parameter - CVE-2025-29189
Lightning Flow Scanner Vulnerable to Code Injection via Unsafe Use of `new Function()` in APIVersion Rule - CVE-2025-67750
`vega-functions` vulnerable to Cross-site Scripting via `setdata` function - CVE-2025-66648

CSRF, XXE, and 12 Other Security Acronyms Explained

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated October 06, 2025